What your walking app knows about you

One walk on a map looks harmless. A line through the woods, a time, a distance. But a walking app rarely holds one walk. It holds hundreds, each with a start, an end and a time of day. Put together, they tell a story about you that you never meant to write down.

A map of your life

Think about where your walks begin. Most start at your front door. Many of the rest start at your office, your parents' house or the car park you always use. Look at the times, and the tracks show when you leave the house, when you come back, and which weekends you are away.

None of this needs your name. If most of your walks begin at one address, that address is almost certainly where you live. Whoever can see your tracks can work that out in a minute. That is why I built walker, the walk, hike and ride tracker I make for Android: I wanted to record my walks without handing that story to anyone.

When fitness data told too much

This is not a theory. It has happened, more than once, to people who had every reason to be careful.

The Strava heatmap, 2018

In November 2017, Strava published a global heatmap built from more than a billion activities. In January 2018, Nathan Ruser, a 20-year-old Australian student, noticed what it showed in places where few people use fitness apps: bright lines around military bases in countries such as Syria and Afghanistan. In those regions, as Ruser put it, the only people using the apps would be foreign military personnel, and their laps traced the bases' outlines. Strava said at the time that the heatmap left out activities marked as private and respected the privacy zones people had set. (TechCrunch, ABC News)

Polar Flow, 2018

Months later, the research group Bellingcat and the Dutch outlet De Correspondent looked at Polar's Flow platform, which could show all of one person's public workouts on a single map. People tend to start and stop their tracker at home, and the researchers used that. They found people exercising at sensitive sites, then followed their other workouts back to where they ended. They identified nearly 6,500 users at more than 200 sensitive sites. For the time being, Polar suspended the feature that made this possible. (Bellingcat)

Bodyguards, 2024

Journalists at Le Monde showed that some bodyguards of world leaders posted their runs on Strava. By following those runs, they could tell where the leaders they protected were staying. In one case, they traced a private weekend the French president spent in Honfleur in 2021, which was not on his official agenda. The US Secret Service said it saw no impact on its protection work. (Fortune, The Register)

You are probably not a soldier or a bodyguard. But the method in each case was simple: public tracks, a map and some patience. None of it depends on who you are.

"Anonymous" does not mean safe

Some apps say they share only anonymous data. It helps less than it sounds.

In 2013, researchers led by Yves-Alexandre de Montjoye studied 15 months of location data from 1.5 million mobile phone users. The data held no names, and each place was only as precise as the nearest phone mast. Even so, four points in time and place were enough to pick out 95 per cent of the people in it. (Scientific Reports)

That study used phone data, not walking tracks. A GPS track is far more precise, so if anything, it gives away more.

What you can do today

You don't need to give up your app. A few settings make a big difference.

• Hide where your walks start and end. Many apps call this a privacy zone. In Strava, it is under Settings → Privacy Controls → Map Visibility. You can hide the area around an address, the start and end of every activity, or the whole map. (Strava Help)
• Check who can see your activities. Hiding the start and end does not make an activity private. Strava's help page points out that an activity set to "Everyone" is still visible to everyone, just with the ends hidden. Choose who sees your walks as well.
• Check your location permission. On Android, Settings → Apps → your app → Permissions shows whether an app can use your location all the time, only while you use it, or never. Ask yourself whether it really needs more than it has. (Android Help)
• Read the Data safety section. Every app on Google Play has one. The developer uses it to say what data the app collects, whether it shares it, and how you can delete it. (Google Play Help)
• Take your data with you, then clean up. Before you delete an account, export your walks. Strava, for example, lets you download your whole account from its website, and Own your walks shows how, step by step. In the EU, the General Data Protection Regulation (the GDPR) gives you the right to a copy of the data a company holds about you (Article 15) and the right to ask for it to be deleted (Article 17). Under Article 20 you can also ask for that data in a common machine-readable format, so you can take it elsewhere. (Strava Help, EUR-Lex)

How walker handles it

walker works differently from most trackers. There is no account, so there is nothing to sign up for, and no server, so there is nowhere for your tracks to be sent. walker sends no data about you to me or to anyone else, and it has no analytics and no crash reporting of its own. Your tracks, steps and statistics stay on your phone. There are no ads and no in-app purchases either. You buy walker once, and there is no subscription.

walker goes online only for downloads. You start each of these yourself: map regions (from Protomaps), terrain for a map region (from Mapterhorn), and in Germany map and aerial-photo areas (from BKG, the federal mapping agency, and the states). walker can also download the day's satellite orbits (from BKG), one public file that is the same for everyone and lets walker clean a track with the satellites' own measurements. Whether it does is your choice, under Settings → Recording → Download satellite orbits. With Ask, the default, walker asks you first. With Always it downloads without asking, and Never turns it off. Each server learns your internet address and the area you asked for, or for the orbits only the date. None of them learns your position or your tracks. The privacy policy has the details.

You can check this yourself. Privacy & storage shows what walker stores and lists every download it made. That screen also has Delete all data, one button that removes everything walker has stored.

Before a walk goes to another app, walker asks Share the whole track?. The file holds every point you recorded, and the other app may upload it.

Whichever app you use, the question is who can see where you have been. The settings above let you answer it in any app. With walker, your tracks stay on your phone unless you share them. Your walks will always tell a story. Who gets to read it is your choice.