Last time, I overviewed how you could reverse-engineer Strava's privacy zones from 40 activities in a city, using a range of geometric methods. It worked surprisingly well, but it left me thinking: what if you don't have 40 activities? Suppose you've only uploaded 10 or even fewer. Can someone still pinpoint your front door? And if so, how accurately?
It turns out, you really don't need many activities to get a shockingly close estimate, in many cases just a few activities are enough.
How Predictions Change With Fewer Activities
The point here isn't just academic. A lot of people aren't uploading dozens of runs or rides every week. If privacy zones can only be reverse-engineered from lots of activities, maybe most people are safe. But if just a handful of uploads are enough then we have a problem.
So, I ran the numbers again. Using the dataset from the original post, I sampled subsets of 10, 20 and 30 activities and compared them to the full 40. The goal was simple: see how prediction accuracy changes as the number of activities drops.
Sampling the Routes
Here's how it looks visually:
10 Activities
20 Activities
30 Activities
Even with 10 activities, you can already see patterns emerging. Visually it looks like there's enough information to get a rough idea of the true start location.
Reverse-Engineering With Less Data
The results were surprisingly robust. Let's look at each sample size in turn, with maps showing the predicted start locations for all five methods.
Even with only 10 activities, the predictions are already quite close. The Simple Average Method comes in best at 28.5m, while the other methods range from 28.6m to 37.5m, a surprisingly tight spread. Looking at the map, the start points themselves are fairly diverse hinting at why even a small sample can yield a strong prediction given the right distribution of points.
Adding 10 more activities tightens the Simple Average Method dramatically, down to just 7.3m, a testament to how averaging benefits from more data and the importance of the right distribution of points. Other methods remain consistent, with small fluctuations. On the map, you'll notice many start points are repeated; there are only so many ways to leave home, which helps the geometric methods remain stable.
The results for 30 activities are remarkably similar to 20. The Simple Average Method is still the closest, though slightly higher at 10.5m, while the boundary and donut-based methods barely change. The repeated start points continue to stabilise predictions. Essentially, adding more activities beyond 20 doesn't drastically change the overall outcome too much.
Here's an interesting twist: with the full 40 activities, the Simple Average Method actually performs worse than with 20 or 30. This is not a bug, it's a quirk of the point distribution. Tiny clusters of points in one direction can skew the average, while the other geometric methods remain relatively stable.
Key Patterns Across All Samples
| Method | 10 Activities | 20 Activities | 30 Activities | 40 Activities |
|---|---|---|---|---|
| Simple Average Method | 28.5m | 7.3m | 10.5m | 29.9m |
| Boundary Method | 37.5m | 38.7m | 38.7m | 37.4m |
| Circle Fit Method | 37.3m | 28.2m | 34.7m | 33.9m |
| Donut Overlap Method | 32.0m | 25.2m | 25.4m | 28.5m |
| Adaptive Donuts Method | 28.6m | 31.9m | 32.4m | 31.0m |
- A handful of activities is enough. Ten points already give a strong estimate. Typically to around 30m - that's just a fraction of the 200m privacy radius.
- Methods differ in stability. The boundary and Adaptive Donuts methods are the most consistent across sample sizes. The Simple Average Method is more volatile but can outperform others if the points are well-distributed. The Donut Overlap and Circle Fit methods stay moderately consistent.
- Distribution beats quantity. Even a small, well-spread sample can outperform a larger, clustered dataset.
How Few is Too Few?
What about just 5 activities?
Here we start seeing the limits. With so few points, the Simple Average and boundary methods simply don't have enough information to anchor their predictions, so their estimates drift more than before. In contrast, the Adaptive Donuts and Circle Fit methods remain reasonably close (~37m). Just five activities - hardly anything - can still narrow the possibilities dramatically.
Think about that for a second: most people assume "200m privacy radius = safe". In reality, three to five well-distributed activities are enough to triangulate a likely home location to within 50m. That's just a couple of activities that could put you at risk.
Why does it still work with so little data?
Even five activities can give a good outline of the basic shape of movement away from the start location - just enough structure for some geometric methods to converge towards the true location.
And there's another important detail: here I'm only using start locations. In practice, most activities start and finish at the same location, which effectively doubles the number of usable points. Five activities often means around ten location points - and that means even two or three well-distributed activities may be enough to reveal someone's home with surprising accuracy.
- 5 Activities = 10 Data Points
- 3 Activities = 6 Data Points
- 2 Activities = 4 Data Points
So yes, prolific uploading helps, but it isn't required. Even a casual Strava user can leak meaningful location information from just a few activities.
Wrapping Up - What This Means (And What's Next)
The takeaway is clear: you don't need dozens of activity uploads for your home location to be discoverable. Even a handful of activities can yield a strong estimate, within just 30-40m for this city sample. With start and finish points considered, this number could be as low as two or three activities.
So if just a handful of activities can give away your home, what happens when you tweak the only real defence Strava offers - the size of the privacy zone itself? Does a bigger radius actually hide you, or just delay the inevitable? That's what I'll explore next time in Does a Larger Privacy Zone Protect You on Strava?.