Hello Strava Developer Community,
We are preparing an Android app for the Salem Randonneurs cycling club and would appreciate guidance on whether our proposed Strava integration complies with the API Agreement and API Policy effective June 1, 2026. We have not launched publicly or begun multi-rider testing.
Riders authorize their own Strava accounts. The app imports outdoor rides during a monthly club challenge and calculates mileage and/or elevation standings. Our current implementation requests read and activity:read_all. It stores the Strava athlete ID and encrypted OAuth tokens, plus each imported ride’s ID, date, type, distance, elevation, and eligibility/review status. It does not intentionally store route/GPS, heart-rate, or power data. Club administrators can review ride records. Published results show participant names, totals, and rankings to app users.
Could a Strava representative please clarify:
-
Whether club administrators may review a rider’s activity-level data for challenge eligibility.
-
Whether participants may see other participants’ names and derived totals or rankings, and how Policy sections 2.3, 6.1, and 6.2 apply together.
-
What activity-level fields may be retained, and for how long; whether derived challenge totals or results may be retained after activity records are deleted.
-
Which OAuth scopes are appropriate for this use, and what handling is required when a rider revokes access or deletes an activity.
-
Whether we should submit this design through the Developer Program review process before proceeding.
We understand that individual consent or a closed club does not by itself establish that a use is allowed. We will keep the integration limited to current testing until we receive guidance. We can provide app screenshots and the privacy policy, but will not post API credentials, tokens, or secrets.
Thank you,
Salem Randonneurs app team