Weeks of work thrown away, two rejections, zero feedback. A heads-up for fellow developers.
I want to share our experience, both as a warning and as a recommendation, because I wish someone had shared this with me before I threw weeks of work away.
We built a trail running community app for a small mountain region, where the idea was simply for people to follow each other's training and prepare together for the local races. A niche, closed community around a mountain running brand. The Strava integration was optional and free, and it was there so members could see their own progress and stay motivated during their preparation.
After a first rejection, we did everything by the book. We read the API Agreement and the API Policy line by line, reworked the product so the integration only ever exposes each athlete's own data, capped it within the Standard Tier, implemented the 7-day cache with an automated cleanup job, full deletion on disconnect, 48-hour deletion via webhooks, minimal activity:read scope, no photo re-hosting, and we made sure the app actively drives engagement back to Strava. We published a privacy policy that maps section by section to the API Policy. We aligned every screen, every document, every claim. Entire weeks went into that compliance work alone.
Second submission. Rejected again. The same generic template. No individual feedback, no indication of which requirement we supposedly failed, no path to fix it. Just the standard list of "common reasons" and the reminder that access is not guaranteed. All of that work, weeks of it, simply thrown away without a single line of explanation.
Here is my honest issue. It's not the rejection itself. Strava is entitled to decide who uses their API and to be restrictive. The problem is the complete absence of feedback after asking developers to invest serious time proving compliance. If an app is structurally incompatible with your platform's intent, tell us in one line so we can stop. Don't let us spend weeks polishing a submission against a wall. A single sentence of feedback would save the developer community an enormous amount of wasted effort. Silence after that much good-faith work is, frankly, a lack of respect for the people building on your platform.
So this is my recommendation to other developers, especially anyone building fitness or community apps. Do not assume that meticulous compliance gets you approved. If your core experience depends on reading activity data, budget for the very real possibility that Strava will say no without telling you why, no matter how clean your implementation is. Don't throw weeks of your time away like we did.
And there's a better path that doesn't depend on anyone's approval: read activities natively from Apple HealthKit and Android Health Connect. The user connects their own watch app (Garmin, Coros, etc.) to the phone's health platform, and you read the workouts (distance, duration, elevation, GPS track) straight from the device, with the user's explicit permission. No third-party review, no capacity cap, no waiting weeks for a form letter. It requires a native build (it won't run in a PWA), but it puts you back in control of your own roadmap. That's where we're putting our effort now, and I'd encourage you to consider starting there instead of going down the Strava API path.
Build on platforms that respect your time.
