Fitbit and Strava may be tracking more than your run

It’s the beginning of the new year, which means you and many others may be on a fitness kick right now. Mobile apps, like Fitbit and Nike Training Club, can help you achieve your fitness goals, and there are plenty to choose from. These apps usually require a variety of information to function — like user ID, location, device ID, and crash data — but some of that data tends to be shared with third parties for ad targeting and other purposes. A new report has now laid out which fitness apps are the least privacy-friendly.

The VPN and data security company Surfshark has released a new report comparing the top 16 fitness apps in terms of data collection. According to the firm, the information it gathered is sourced from Apple’s App Store page, which lists “35 unique data types categorized into 16 unique data point categories.” This information was then analyzed by number, type, and the handling of collected data by each app.

With the methodology out of the way, here are the key insights the company learned about the data collection practices of the top 16 fitness apps:

Among the group, it appears that Fitbit is the most data-hungry, collecting 24 of the 35 unique data types defined by Apple. That’s nearly double the average amount of data collected by these types of apps. However, it’s worth pointing out that some of this data is used for app functionality.

Strava, on the other hand, is the leader in “potentially exploiting the most data beyond app functionality, with a total of 21 different data types.” This means it collects the highest amount of tracked data, which could be used for purposes like product personalization, analytics, or marketing.

It was also found that four of these apps collect precise location information linked to the user, including Runna and Strava. Six apps collect coarse location data, with Nike Training Club and Peloton sharing data with third parties. And four apps appear to collect sensitive information, like race, pregnancy details, political opinions, and so on. Surfshark points to Nike Training Club as one of the four apps that collect sensitive information and share it with third parties.

Meanwhile, it seems Centr is the least data-hungry app, collecting only three types of data: user ID, product interaction, and crash data. However, it appears that all three of those data types are tracked. PUSH stands out as the most privacy-friendly app, collecting data without linking it to the user and only using the data for app functionality.