Acceptable Use Policy

Security & Safeguards · Restriction or exception

Examples: automated systems, bulk accounts and burdensome load

Examples of excessive automated, bulk, spammy or burdensome activity include using any automated system (such as robots, spiders or offline readers) to access the Services in a way that sends more requests than a human could reasonably produce with a conventional web browser; creating accounts in bulk; using extensions or other means to bypass limits on automated interactions such as kudos or comments; and any action that imposes, or may impose, an unreasonable or disproportionately large load on Strava's infrastructure, which Strava judges at its sole discretion.

Supporting quotations

Excessive automated, bulk, spammy, or burdensome activity, including

Using any automated system, including “robots,” “spiders,” “offline readers,” to access the Services in a manner that sends more requests to Strava than a human can reasonably produce in the same period of time by using a conventional web browser

Creating accounts in bulk

Using extensions or other means to bypass limits on automated interactions such as kudos or comments

Taking any action that imposes, or may impose, at our sole discretion, an unreasonable or disproportionately large load on our infrastructure

Qualifications & exceptions

• The automation example is measured against what a human could reasonably produce in the same period using a conventional web browser.
• Whether a load is unreasonable or disproportionately large is determined at Strava's sole discretion, and the example covers actions that may impose such a load.

Cross-references

• refers to (model-proposed): Accessing, harvesting or distributing the Services outside authorized means — The spam section's automated-access example overlaps the security section's rules on access by unauthorized means and scraping.

Security & Safeguards · Restriction or exception

Malicious content and phishing are prohibited

Prohibited content includes content that is harmful to or interferes with Strava's or any third party's networks, equipment, applications, services or websites (for example viruses, worms or Trojan horses), and content intended to or likely to deceive, mislead or defraud others through phishing or social engineering techniques.

Supporting quotations

Content that is malicious or harmful to systems:

Content that is harmful to or interferes with Strava’s or any third party’s networks, equipment, applications, services or websites (e.g., viruses, worms, Trojan horses)

Content that is intended to or likely to deceive, mislead, or defraud others through phishing or social engineering techniques

Qualifications & exceptions

• The harm covers third parties' systems as well as Strava's.
• The deception limb covers content intended to, or likely to, deceive, mislead or defraud through phishing or social engineering.

Security & Safeguards · Restriction or exception

Unauthorized access or use of Strava, and malicious activity against it, are prohibited

Strava does not allow unauthorized access or unauthorized use of Strava, and prohibits any harmful or malicious activity against its websites, related mobile applications and services. The policy calls these the 'Services' for the rest of the security section.

Supporting quotations

We do not allow unauthorized access or unauthorized use of Strava.

We also prohibit any harmful or malicious activity against our websites, related mobile applications, and services (referred to collectively as “Services” below).

Qualifications & exceptions

• 'Services' means Strava's websites, related mobile applications and services, as used in the security section.

Security & Safeguards · Restriction or exception

Accessing, harvesting or distributing the Services outside authorized means

Under 'Unauthorized access or use of information', the policy prohibits accessing any content on the Services through any technology or means other than those the Services provide or authorize; collecting or harvesting information relating to an identified or identifiable individual, including account names and information about users, from the Services; and distributing or disclosing any part of the Services in any medium, including by automated or non-automated 'scraping'.

Supporting quotations

Unauthorized access or use of information

Accessing any content on the Services through any technology or means other than those provided or authorized by the Services

Collecting or harvesting any information relating to an identified or identifiable individual, including account names and information about users of the Services, from the Services

Distributing or disclosing any part of the Services in any medium, including by any automated or non-automated “scraping”

Qualifications & exceptions

• The harvesting example covers information relating to an identified or identifiable individual, including account names and information about users.
• Distributing or disclosing any part of the Services is prohibited in any medium, whether scraping is automated or not.

Not stated here

• The policy does not say whether sharing your own activity data or content through authorized features is covered by the distribution rule.

Cross-references

• referred to by (model-proposed): Examples: automated systems, bulk accounts and burdensome load — The spam section's automated-access example overlaps the security section's rules on access by unauthorized means and scraping.

Security & Safeguards · Restriction or exception

Using the Services in a way they are not intended is prohibited

The policy prohibits using the Services in a manner for which they are not intended, as determined at Strava's sole discretion, with employee tracking and automotive mileage reimbursement purposes given as examples.

Supporting quotations

Using the Services in a manner for which they are not intended, at our sole discretion, (e.g., employee tracking or automotive mileage reimbursement purposes)

Qualifications & exceptions

• Whether a use is not intended is determined at Strava's sole discretion.
• Employee tracking and automotive mileage reimbursement are examples (introduced with 'e.g.'), not a complete list.

Not stated here

• The policy does not list other uses that Strava treats as not intended.

Security & Safeguards · Restriction or exception

Submitting personally identifiable information is limited to what account operation needs

The policy prohibits submitting to the Services or to Strava any personally identifiable information, except as necessary for the establishment and operation of your account.

Supporting quotations

Submitting to the Services or to Strava any personally identifiable information, except as necessary for the establishment and operation of your account

Qualifications & exceptions

• The exception is for personally identifiable information necessary for the establishment and operation of your account.

Not stated here

• The policy does not define 'personally identifiable information' or say how it applies to profile details, photos or other content users post.

Security & Safeguards · Restriction or exception

Network monitoring and packet interception are prohibited

The policy prohibits network monitoring, or running a network analyzer, packet sniffer or other technology to intercept, decode, mine or display packets used to communicate between the Service's servers, or any data not intended for you.

Supporting quotations

Executing any form of network monitoring or running a network analyzer or packet sniffer or other technology to intercept, decode, mine, or display any packets used to communicate between the Service's servers or any data not intended for you

Security & Safeguards · Restriction or exception

Prohibited uses: monitoring, third-party access, copying and bypassing protections

Under 'Unauthorized use of the Services', the policy prohibits accessing the Services to monitor their availability, performance or functionality; permitting any third party to access the Services unless approved by Strava; copying, framing or mirroring any part of the Services; bypassing measures Strava may use to prevent or restrict access, including features that prevent or restrict use or copying of any content; and removing copyright, trademark or other proprietary rights notices on the Services.

Supporting quotations

Unauthorized use of the Services

Accessing the Services to monitor its availability, performance, or functionality

Permitting any third party to access the Services unless approved by Strava

Copying, framing, or mirroring any part of the Services

Bypassing the measures we may use to prevent or restrict access to the Services, including features that prevent or restrict use, or copying of any content

Removing any copyright, trademark, or other proprietary rights notices contained in or on the Services

Qualifications & exceptions

• Third-party access is allowed only if approved by Strava.

Not stated here

• The policy does not say how a third party obtains Strava's approval.

Security & Safeguards · Restriction or exception

Reverse engineering and extracting source code

The policy prohibits using, copying, modifying, creating a derivative work of, reverse engineering, decompiling or otherwise attempting to extract the source code of the software underlying the Services or any part of it, unless expressly permitted or required by law, and in any case without providing prior written notice to Strava.

Supporting quotations

Using, copying, modifying, creating a derivative work of, reverse engineering, decompiling or otherwise attempting to extract the source code of the software underlying the Services or any part thereof, unless expressly permitted or required by law, and in any case, without providing prior written notice to Strava

Qualifications & exceptions

• The rule has a carve-out for what is expressly permitted or required by law, and the sentence also refers to doing so 'without providing prior written notice to Strava'.

Not stated here

• The sentence does not make clear whether prior written notice to Strava is required even where the law permits or requires the activity, or how the legal exception and the notice wording fit together.

Security & Safeguards · Restriction or exception

Disrupting the Services and security-probing activity are prohibited

Under 'Harmful or malicious activity', the policy prohibits attempting to disrupt, degrade, impair or violate the confidentiality, integrity or availability of the Services or of other parties' computers, services, accounts or networks, including denial of service attacks. It also prohibits any activity that typically precedes attempts to breach security, such as scanning, probing or other testing or vulnerability assessment, and engaging in or permitting network or hosting activity that results in a deny list or other blockage of Strava's internet protocol space.

Supporting quotations

Harmful or malicious activity

Attempting to disrupt, degrade, impair or violate the confidentiality, integrity, or availability of the Services or the computers, services, accounts, or networks of any other party including denial of service attacks

Any activity that typically precedes attempts to breach security such as scanning, probing, or other testing or vulnerability assessment activity, or engaging in or permitting any network or hosting activity that results in a deny list or other blockage of Strava internet protocol space

Qualifications & exceptions

• The security-precursor rule covers activity that 'typically precedes' breach attempts, such as scanning, probing and vulnerability assessment, and does not describe an authorization route for security testing.

Not stated here

• The policy does not say whether any authorized or good-faith vulnerability testing is allowed.