Examples: automated systems, bulk accounts and burdensome load
Examples of excessive automated, bulk, spammy or burdensome activity include using any automated system (such as robots, spiders or offline readers) to access the Services in a way that sends more requests than a human could reasonably produce with a conventional web browser; creating accounts in bulk; using extensions or other means to bypass limits on automated interactions such as kudos or comments; and any action that imposes, or may impose, an unreasonable or disproportionately large load on Strava's infrastructure, which Strava judges at its sole discretion.
Supporting quotations
Excessive automated, bulk, spammy, or burdensome activity, including
Using any automated system, including “robots,” “spiders,” “offline readers,” to access the Services in a manner that sends more requests to Strava than a human can reasonably produce in the same period of time by using a conventional web browser
Creating accounts in bulk
Using extensions or other means to bypass limits on automated interactions such as kudos or comments
Taking any action that imposes, or may impose, at our sole discretion, an unreasonable or disproportionately large load on our infrastructure
Qualifications & exceptions
The automation example is measured against what a human could reasonably produce in the same period using a conventional web browser.
Whether a load is unreasonable or disproportionately large is determined at Strava's sole discretion, and the example covers actions that may impose such a load.
Prohibited content includes content that is harmful to or interferes with Strava's or any third party's networks, equipment, applications, services or websites (for example viruses, worms or Trojan horses), and content intended to or likely to deceive, mislead or defraud others through phishing or social engineering techniques.
Supporting quotations
Content that is malicious or harmful to systems:
Content that is harmful to or interferes with Strava’s or any third party’s networks, equipment, applications, services or websites (e.g., viruses, worms, Trojan horses)
Content that is intended to or likely to deceive, mislead, or defraud others through phishing or social engineering techniques
Qualifications & exceptions
The harm covers third parties' systems as well as Strava's.
The deception limb covers content intended to, or likely to, deceive, mislead or defraud through phishing or social engineering.
Security & Safeguards · Restriction or exception
Unauthorized access or use of Strava, and malicious activity against it, are prohibited
Strava does not allow unauthorized access or unauthorized use of Strava, and prohibits any harmful or malicious activity against its websites, related mobile applications and services. The policy calls these the 'Services' for the rest of the security section.
Supporting quotations
We do not allow unauthorized access or unauthorized use of Strava.
We also prohibit any harmful or malicious activity against our websites, related mobile applications, and services (referred to collectively as “Services” below).
Qualifications & exceptions
'Services' means Strava's websites, related mobile applications and services, as used in the security section.
Security & Safeguards · Restriction or exception
Accessing, harvesting or distributing the Services outside authorized means
Under 'Unauthorized access or use of information', the policy prohibits accessing any content on the Services through any technology or means other than those the Services provide or authorize; collecting or harvesting information relating to an identified or identifiable individual, including account names and information about users, from the Services; and distributing or disclosing any part of the Services in any medium, including by automated or non-automated 'scraping'.
Supporting quotations
Unauthorized access or use of information
Accessing any content on the Services through any technology or means other than those provided or authorized by the Services
Collecting or harvesting any information relating to an identified or identifiable individual, including account names and information about users of the Services, from the Services
Distributing or disclosing any part of the Services in any medium, including by any automated or non-automated “scraping”
Qualifications & exceptions
The harvesting example covers information relating to an identified or identifiable individual, including account names and information about users.
Distributing or disclosing any part of the Services is prohibited in any medium, whether scraping is automated or not.
Not stated here
The policy does not say whether sharing your own activity data or content through authorized features is covered by the distribution rule.
Security & Safeguards · Restriction or exception
Using the Services in a way they are not intended is prohibited
The policy prohibits using the Services in a manner for which they are not intended, as determined at Strava's sole discretion, with employee tracking and automotive mileage reimbursement purposes given as examples.
Supporting quotations
Using the Services in a manner for which they are not intended, at our sole discretion, (e.g., employee tracking or automotive mileage reimbursement purposes)
Qualifications & exceptions
Whether a use is not intended is determined at Strava's sole discretion.
Employee tracking and automotive mileage reimbursement are examples (introduced with 'e.g.'), not a complete list.
Not stated here
The policy does not list other uses that Strava treats as not intended.
Security & Safeguards · Restriction or exception
Submitting personally identifiable information is limited to what account operation needs
The policy prohibits submitting to the Services or to Strava any personally identifiable information, except as necessary for the establishment and operation of your account.
Supporting quotations
Submitting to the Services or to Strava any personally identifiable information, except as necessary for the establishment and operation of your account
Qualifications & exceptions
The exception is for personally identifiable information necessary for the establishment and operation of your account.
Not stated here
The policy does not define 'personally identifiable information' or say how it applies to profile details, photos or other content users post.
Security & Safeguards · Restriction or exception
Network monitoring and packet interception are prohibited
The policy prohibits network monitoring, or running a network analyzer, packet sniffer or other technology to intercept, decode, mine or display packets used to communicate between the Service's servers, or any data not intended for you.
Supporting quotations
Executing any form of network monitoring or running a network analyzer or packet sniffer or other technology to intercept, decode, mine, or display any packets used to communicate between the Service's servers or any data not intended for you
Security & Safeguards · Restriction or exception
Prohibited uses: monitoring, third-party access, copying and bypassing protections
Under 'Unauthorized use of the Services', the policy prohibits accessing the Services to monitor their availability, performance or functionality; permitting any third party to access the Services unless approved by Strava; copying, framing or mirroring any part of the Services; bypassing measures Strava may use to prevent or restrict access, including features that prevent or restrict use or copying of any content; and removing copyright, trademark or other proprietary rights notices on the Services.
Supporting quotations
Unauthorized use of the Services
Accessing the Services to monitor its availability, performance, or functionality
Permitting any third party to access the Services unless approved by Strava
Copying, framing, or mirroring any part of the Services
Bypassing the measures we may use to prevent or restrict access to the Services, including features that prevent or restrict use, or copying of any content
Removing any copyright, trademark, or other proprietary rights notices contained in or on the Services
Qualifications & exceptions
Third-party access is allowed only if approved by Strava.
Not stated here
The policy does not say how a third party obtains Strava's approval.
Security & Safeguards · Restriction or exception
Reverse engineering and extracting source code
The policy prohibits using, copying, modifying, creating a derivative work of, reverse engineering, decompiling or otherwise attempting to extract the source code of the software underlying the Services or any part of it, unless expressly permitted or required by law, and in any case without providing prior written notice to Strava.
Supporting quotations
Using, copying, modifying, creating a derivative work of, reverse engineering, decompiling or otherwise attempting to extract the source code of the software underlying the Services or any part thereof, unless expressly permitted or required by law, and in any case, without providing prior written notice to Strava
Qualifications & exceptions
The rule has a carve-out for what is expressly permitted or required by law, and the sentence also refers to doing so 'without providing prior written notice to Strava'.
Not stated here
The sentence does not make clear whether prior written notice to Strava is required even where the law permits or requires the activity, or how the legal exception and the notice wording fit together.
Security & Safeguards · Restriction or exception
Disrupting the Services and security-probing activity are prohibited
Under 'Harmful or malicious activity', the policy prohibits attempting to disrupt, degrade, impair or violate the confidentiality, integrity or availability of the Services or of other parties' computers, services, accounts or networks, including denial of service attacks. It also prohibits any activity that typically precedes attempts to breach security, such as scanning, probing or other testing or vulnerability assessment, and engaging in or permitting network or hosting activity that results in a deny list or other blockage of Strava's internet protocol space.
Supporting quotations
Harmful or malicious activity
Attempting to disrupt, degrade, impair or violate the confidentiality, integrity, or availability of the Services or the computers, services, accounts, or networks of any other party including denial of service attacks
Any activity that typically precedes attempts to breach security such as scanning, probing, or other testing or vulnerability assessment activity, or engaging in or permitting any network or hosting activity that results in a deny list or other blockage of Strava internet protocol space
Qualifications & exceptions
The security-precursor rule covers activity that 'typically precedes' breach attempts, such as scanning, probing and vulnerability assessment, and does not describe an authorization route for security testing.
Not stated here
The policy does not say whether any authorized or good-faith vulnerability testing is allowed.