Strava Can Hide Your Home. Researchers Found It Anyway

In 2023, a few hours before Joe Biden arrived at the San Francisco hotel where he stayed for talks with China’s Xi Jinping, one of his Secret Service agents went for a run from that hotel and recorded the route on Strava. The French newspaper Le Monde found that run, the Associated Press reported, while tracing the public Strava profiles of 26 Secret Service agents, 12 members of France’s presidential security group and six members of Russia’s Federal Protection Service.

Nothing about those runs was unusual. Strava shows an adult’s activities to everyone unless the setting is changed, and the place a route keeps starting from is often a home or a workplace. Strava does offer ways to hide where a route begins and ends. This guide looks at what happened when researchers tried to see through them, what the Strava heatmap can give away, and which settings actually keep your address off the map.

Strava says it has more than 195 million athletes in over 185 countries, and its help centre lists the privacy defaults every new adult account starts with. Profile, activities and group activities are visible to Everyone. Flyby, which replays your activity alongside other people’s nearby, is set to No One. Map Visibility hides the first and last 200 metres of future activity maps.

A public activity shows the route on a map, when it happened and how far it went. One activity is a line; a few months of them are a routine, with a start point that hardly moves. Accounts opened by under-18s start with stricter settings, covered further down.

The heatmap Strava released in November 2017 drew a billion activities, more than 3 trillion GPS points according to the company, as glowing lines on a dark map. In January 2018, Nathan Ruser, an analyst with the Institute for United Conflict Analysts, pointed out that US bases were “clearly identifiable and mappable”. In Afghanistan, Djibouti and Syria, the Guardian reported, Strava’s users seemed to be almost all foreign military personnel, so the bases stood out. Zooming in on one large base showed its internal layout, traced by soldiers’ jogging routes.

Le Monde’s 2024 investigation used individual profiles instead. By following the runs of Emmanuel Macron’s bodyguards, it placed the French president in Honfleur for a private 2021 weekend that was not on his official agenda. For its part, the US Secret Service told Le Monde: “We do not assess that there were any impacts to protective operations or threats to any protectees.”

In July 2025 it was Sweden’s turn. The newspaper Dagens Nyheter reported that seven members of the country’s security service had shared runs and rides that revealed the royal family’s private holidays, NBC News reported. The paper’s earlier reports had found that bodyguards’ workout data exposed details about Prime Minister Ulf Kristersson on at least 35 occasions, including his running routes, trips abroad and private address. Strava told NBC News there had been no leak or breach of user data, and that it expects users in sensitive professions to use the privacy settings available.

In none of these cases was Strava hacked. The activities were public, and the places they started from said the rest.

The everyday version is a bike theft. In 2015, Mark Leigh, a cyclist in Failsworth near Manchester, told the Manchester Evening News that his garage was broken into the morning after a ride he had tracked on Strava, and his two bikes, worth £500 and £1,000, were taken. Nothing else went, and he believed the thieves had found him through the app. He had not known about its setting for hiding his home, The Register reported.

Researchers have tested that kind of setting more than once. In 2022, a team at KU Leuven in Belgium studied Strava’s privacy zones: circles around a protected address, inside which a route is hidden from other people. Their attack used three things anyone could see: the street map, the points where a route crossed into the hidden circle, and the distance figures, which still counted the hidden stretch. Across several activities, they looked for the spot on the street grid that best fitted all those distances.

“Among the 1.4 million Strava activities we analysed, we were able to uncover up to 85 percent of the hidden locations anyway, based purely on the additional data that was publicly available,” said researcher Victor Le Pochat. That figure was for zones of 200 metres, the size most Strava users chose. Bigger zones helped but did not end it: the success rate was 55% at 1 km, and 39% at 1.6 km, the largest size Strava then offered.

Strava has changed the feature since. Map Visibility can now hide the area around an address, hide the start and end of every activity wherever it happens, or hide the whole map, and new adult accounts get 200 metres hidden at each end by default. The KU Leuven paper discussed hiding a set distance at each end, which Strava had recently introduced, and wrote that it only made one step of the attack less reliable: the cut-off points and distances stayed available for the prediction.

Strava’s own help page is candid about the limit. Hiding part of a map, it says, “does not mean it would be impossible for someone to deduce a hidden location using additional information”, and it points anyone who wants no map shown to the option that hides it completely. Strava also told Cycling Weekly in 2023 that there had been “no leaks and no cyber attacks involving Strava or our community’s data in regards to this research”. The researchers never said otherwise: their method used only what the app showed in public, a leak of the same kind that researchers have found in dating apps.

“In a densely populated area, with lots of routes and lots of users, there is so much data that it would be extremely difficult to track any specific person,” said Anupam Das, the study’s senior author. “However, in areas where there are few users and/or few routes, it becomes a simple process of elimination,” particularly for a highly active user. His team flagged 143,799 points of interest on the heatmap and matched 11,165 Strava users to voter records to check their guesses.

The search side was just as simple. The researchers looked users up by the town named in their profiles, and at the time even accounts set to followers-only turned up in that search. Users who had left their city blank could not be found that way.

Strava’s current rules close part of that gap. Its help centre says the Global Heatmap shows activity from the last year, updated monthly, and leaves out activities not set to Everyone, portions hidden by map visibility settings, and activities from people who have opted out. No heat appears in an area until multiple users have been active there.

1. Step 1Make activities followers-onlyIn the app, open the You tab, tap the settings icon, then Privacy Controls, and set Activities to Followers, or to Only You for runs you keep to yourself. Set Profile to Followers too, so people have to request to follow you and wait for your approval; Strava says this also stops search engines indexing your profile. Strangers then see no route at all.
2. Step 2Hide your home addressUnder Privacy Controls > Map Visibility, enter your address. Strava then hides the part of any past or future activity that starts or ends nearby, and you choose how much, up to a mile (about 1.6 km). Add work, school or a partner’s home as well, and pick a large distance: “The bigger, the better,” said KU Leuven researcher Karel Dhondt.
3. Step 3Hide the start and end of everythingThe second Map Visibility option hides the start and end of all future activities wherever they begin, which covers a hotel, a friend’s flat or a new address you forgot to add. The default is 200 metres; a longer distance hides more. For no map at all, the third option hides the whole map.
4. Step 4Start and finish somewhere elseThe KU Leuven researchers also advised varying where you start and finish. Walk a few minutes before you press start, and stop recording before you turn into your street. A hidden zone cannot give away a door the route never reaches.
5. Step 5Opt out of the heatmapIn Privacy Controls, turn off the setting that contributes your data to Strava’s aggregate features: Product Improvements in Strava’s current help pages, called aggregated data usage in older ones. Strava says opted-out data is left out of the Global Heatmap and Strava Metro.
6. Step 6Check what your profile saysThe NC State team found users by searching for everyone who listed a given town. Leave the city out of your profile, or keep it broad.
7. Step 7Leave Flyby offFlyby is off by default and only includes activities visible to Everyone. If you opted in, consider opting back out.

New followers also have to ask for approval first, and that is where parents come in. A club session or school run that starts from home shows the same pattern to every follower who has been approved, so look at who they are and add the home address under Map Visibility. A teenager’s activities belong in the same conversation as what a child’s photos tell strangers.

The zones also differed. Strava offered circles from 200 metres to 1.6 km and Garmin Connect from 100 metres to 1 km, while Komoot used a randomly shaped area instead of a circle, which the researchers noted makes the zone harder to work out. Whatever the app, the first setting to change is the one that makes activities public.

A hidden map only hides the line. Removing EXIF data takes the coordinates out of the file, and one selfie can reveal where you live lists the clues a camera picks up: door numbers, street signs, the view from a window. Photos from the same corner, week after week, build the kind of pattern described in the photo metadata privacy risks.

Strava places photos too. New adult accounts start with Public Photos on Routes switched on, so photos from public activities can appear on Strava’s community routes, not linked to your account. Photos taken inside an address you have hidden are left out, and the setting can be switched off under Privacy Controls.

Photo analysis on geospys.com is part of GeoSpy Premium: 7.99 US dollars a week or 29.99 US dollars a year (get Yearly), unlimited within fair use and cancellable any time. It estimates a city and a country, not an address. The GeoSpy iPhone app has a free trial.