Your GPS Track Is Personal Data: Why Open Source Matters for Sports Apps

OpenWater Guides · Updated August 8, 2026

What a GPS track actually gives away

A session file looks harmless — a squiggle on a map, a top speed, some heart rate. But the same file answers questions you were never asked:

• Where you live. Tracks tend to start and stop where you parked or where you launched. Do it fifty times and the cluster is unambiguous.
• When you are out. Timestamps show which mornings and which hours you are reliably not at home, for months into the past.
• Who you ride with. Two tracks in the same place at the same time is a social graph, inferred without either of you writing anything down.
• Where the good spots are. A sensitive one in foiling — plenty of launches are quietly kept quiet, and an aggregate heatmap publishes them whether or not the locals wanted that.

Location history is notoriously hard to anonymise. Stripping names off the data does not help much when the data itself points at one house, every night, for a year.

This has already gone wrong, publicly

These aren't hypotheticals. Two well-documented incidents, six months apart, show exactly how it fails.

Strava, January 2018. Strava had published a global heatmap in November 2017, built from the GPS data of tens of millions of users. Nathan Ruser, then an international security student at the Australian National University, noticed jogging routes glowing in otherwise empty stretches of the Syrian desert. As Alex Hern reported in the Guardian, the heatmap was tracing the perimeters, internal layouts and patrol routes of military bases in Syria, Iraq and Afghanistan, drawn by soldiers logging ordinary runs — including installations that don't appear on Google or Apple Maps at all. Strava did offer privacy zones, but they were not enabled by default, and as Privacy International noted at the time, most users had no idea the setting existed. Strava later said it would simplify its privacy controls, and the Pentagon reviewed its own guidance on wearables.

Polar, July 2018. Worse, because it was per-person rather than aggregate. Investigators at Bellingcat, working with De Correspondent, found that Polar Flow's "Explore" map would show every exercise a given user had logged since 2014, anywhere in the world, on a single screen. Find one run at a military base, click the profile, and you could see where that same person ran at home. Scraping 200+ sensitive sites turned up roughly 6,500 identifiable users across 69 nationalities and over 650,000 exercises, including personnel at nuclear weapons storage sites, embassies, Guantánamo Bay, troops near the North Korean border, and named staff of the NSA, GCHQ, MI6 and Russia's GRU. Polar suspended the Explore feature, and the Dutch Ministry of Defence told its personnel to delete fitness apps outright.

Note what didn't happen in either case: no breach, no hack, no leak, nobody acting in bad faith. Ordinary people recorded ordinary workouts, and a product feature aggregated them into something nobody intended. That is the characteristic failure of location data — a single track is rarely the problem, it's that tracks combine, and combination is not something you can see happening from inside the app. Both companies responded once it was public. The point is that neither user base could have known beforehand, because the behaviour lived on a server they couldn't inspect.

Why a privacy policy isn't enough on its own

A policy is a statement of current intent by the current owner. It is worth having, and it is genuinely binding in some jurisdictions — but consider the ways it stops describing reality:

• It can be rewritten. Usually with an email you skim and a button you press to keep using the app you already depend on.
• The company can change hands. Your tracks are an asset in an acquisition, and the acquirer's plans are not covered by the policy you originally agreed to.
• Business models drift. "We will never sell your data" is a statement about a company that is not yet under pressure to find revenue.
• Good intentions don't stop breaches. Data that was collected honestly and stored carefully still leaks. Data that was never collected cannot.

None of that requires anyone to be a villain. It only requires a server holding your location history to keep existing while circumstances change around it.

What open source proves — and what it doesn't

Open source is often waved around as a synonym for private, which is sloppy. It is worth being precise, because the precision is what makes it useful.

What you genuinely get:

• You can read exactly what is collected and what is transmitted. Network calls are not a matter of opinion; they are a few lines of code someone can point at.
• You can check the analysis, not just the privacy story. If an app says your speed comes from Doppler velocity, the code either does that or it doesn't.
• Changes are public and permanent. A quietly-added tracking SDK is a commit with an author and a date, visible to everyone watching the repository.
• The app outlives the company. If development stops, the code is still there to build, fork or audit.

What it does not prove: that the binary you downloaded from the App Store was built from the source you just read. Verifying that requires reproducible builds, which most projects — including this one — do not currently offer. Open source also doesn't guarantee anyone has actually looked; "many eyes" only works when the eyes show up.

Which is why the code should be paired with an architecture where privacy doesn't depend on trust at all. An app with no account and no backend cannot quietly retain your history, because there is no "quietly" available to it: you can watch the network yourself, or simply record a full session in airplane mode and notice that nothing is missing afterwards.

How to judge a tracking app

A practical checklist you can run in a few minutes, on any app:

1. Is an account required? A mandatory login usually means a server-side copy of every session. Optional sync is fine; forced sync is a choice about your data made on your behalf.
2. Does it work in airplane mode? Record a real session offline. If everything works, the recording path is local.
3. Read the App Store privacy label. Specifically whether Location appears under "Data Linked to You" and whether anything is used for tracking or advertising.
4. Check the sharing defaults. Does it trim the start and end of a shared track? Are shared links public and indexable, or unlisted?
5. Can you get your data out? A plain export you own is the difference between using a service and being locked inside one.
6. Is the source public — including the analysis? Some apps open-source a wrapper and keep the interesting parts closed. Look for the actual algorithms.

How OpenWater is built

OpenWater is designed so that these questions have structural answers rather than reassuring ones. There is no account and no server: your GPS tracks, heart rate and sessions stay on your device, and location data is never transmitted anywhere. The app contains no analytics SDK, no crash reporter and no advertising identifier. Sharing and export are user-initiated every time, and when you share a track it trims the start and end by default — because that is exactly where your house is. The complete source, including every analysis algorithm, is public.

Two honest footnotes, since the point of the article is that vague claims deserve suspicion. This website uses Google Firebase Analytics for aggregate visitor statistics — that is the site you are reading, not the app, which remains analytics-free. And as noted above, we do not yet publish reproducible builds, so the source proves what the code does rather than what your particular download was compiled from. The full detail is in the privacy policy.