What parents need to know about Strava, the activity-tracking app, including heatmaps, running routes, location leakage, Privacy Zones, and Athlete Privacy Controls.
Strava is a fitness-tracking app popular with runners and cyclists for recording routes and workouts and sharing them with a social following.
Official age
13+
We recommend
16+
Developer
Strava Inc.
Risks
4
Strava is a fitness-tracking and social network used by runners, cyclists, swimmers, and hikers. It records GPS routes, distance, pace, elevation, and heart-rate data and shares activities to a social feed where friends can comment and give 'kudos'. The platform is also used by clubs and schools. Strava aggregates user data into a public heatmap of the world's most-run roads and paths, and the same data underpins the company's segment leaderboards. The default visibility for new activities can result in a child publishing the precise location of their home, school, and routine running routes. Privacy Zones and the Athlete Privacy Controls menu reduce this exposure significantly but must be configured.
Older children and teenagers use Strava to track training for school running, cycling, swimming, and triathlon clubs. Many follow teammates, coaches, and family members and share activities to compare paces and split times. Some use the segment leaderboards competitively, trying to set the fastest time on a local hill or loop. A subset use it socially as much as athletically, posting routes, photos at the end of a ride, and group ride invitations. Because activities default to public visibility on many accounts, a child's first few runs from home can publish a precise map of the front door before any privacy setting is touched.
Privacy Zones
Location: Settings -> Privacy Controls -> Map Visibility -> Privacy Zones
Set to: Add zones for home, school, training club, and any close friend's address used as a meet point
Hides the start and end of activities inside each zone from anyone viewing the map. Strava recommends placing the zone slightly off the actual address so the centre is not obvious.
Activity Visibility (default)
Location: Settings -> Privacy Controls -> Activities
Set to: Followers
Restricts new activities to approved followers by default. 'Only You' is even tighter and recommended for solo training.
Profile Page
Location: Settings -> Privacy Controls -> Profile Page
Set to: Followers
Stops strangers viewing profile photos, recent activities, and clubs without a follow request.
FlyBy
Location: Settings -> Privacy Controls -> FlyBy
Set to: No One
Disables the feature that lets other Strava users see your child's activity on a map alongside their own.
Group Activities and Mentions
Location: Settings -> Privacy Controls -> Group Activities
Set to: Followers
Stops strangers tagging your child into shared rides or runs, which would otherwise publish a joint route.
Set up Privacy Zones around home, school, and training venues before the first activity is recorded
Time: 15 minutes
Set default activity visibility to 'Followers' or 'Only You' and disable FlyBy in the same session
Time: 5 minutes
Open an activity on the map together and check that the start and end points are inside the Privacy Zone before sharing
Time: 10 minutes
Talk about not accepting follow requests from unknown accounts and about not posting in real time during solo training
Time: 10 minutes
In immediate danger: call 999. For non-emergency police matters, call 101.
Concerned about a child but it's not an emergency? NSPCC helpline 0808 800 5000. Childline for young people 0800 1111.
Myth: If my child's Strava profile is set to Followers or Only You, their name won't show up anywhere public.
Fact: Segment leaderboards are controlled by each individual activity's own visibility setting, not the account-level default. An activity shared as 'Everyone' can still put a username on a public leaderboard for a specific stretch of road even when the overall profile is set to Followers, so leaderboard participation needs checking separately rather than assuming the profile setting covers it.
Myth: Once I've set up Privacy Zones and changed the default visibility, the problem is fixed.
Fact: The default visibility setting only applies to activities recorded from that point onward — it does not change the privacy of runs or rides already shared, which stay visible on the map and in the activity history until edited individually. Strava's 'Edit Past Activities' tool can apply the new setting retroactively, and it's worth doing that clean-up in the same sitting as setting up Privacy Zones.
Myth: Strava is a fitness-tracking app, not somewhere a stranger could actually contact my child.
Fact: Strava has direct messaging, and public activities can be commented on or given 'kudos' by anyone who follows the account, which a stranger can request to do after finding a child through a searchable profile or a public segment leaderboard. Because repeated routes reveal not just where a child lives but the times they are likely to be out, the contact risk sits alongside the location risk rather than being a separate, lesser concern.
Strava's minimum age is 13, so this isn't yet an app for their own account. If they join a family bike ride or fun run that gets tracked, record it from a parent's phone and account rather than starting one in their name.
Still at or below the minimum age, so an account at this stage should be locked down before the first activity is even recorded: Privacy Zones around home and school, visibility set to Only You or Followers, and FlyBy turned off. Treat joining public leaderboards as a decision to make with them, not the default.
Independent use can work once Privacy Zones, Followers-only visibility and FlyBy are set up together in one sitting, including cleaning up any activities posted before those settings went in. Talk about not accepting follow requests from people they don't know offline.
They can weigh up the trade-off of sharing routes socially against the location trail it creates, but it's still worth periodically checking that Privacy Zones cover any new address — a training base, a partner's home — and that leaderboard appearances aren't quietly publishing a predictable weekly route.
Practical updates on apps and online safety. No spam.