Millions of Polarsteps users, a popular app among travelers, are exposed to digital security risks. Researchers have discovered that flaws in the app allow unauthorized access to sensitive personal data, raising major concerns about privacy protection. The company, although aware of these issues, is slow to respond effectively.
The key takeaways
- Polarsteps, a travel app, has security flaws that expose the personal data of millions of users.
- The app’s API flaws allow unauthorized access to sensitive information, including location data and photos.
- Dutch authorities could sanction Polarsteps for non-compliance with personal data protection standards.
You have probably dreamed of sharing your travel adventures with your loved ones in a simple and captivating way. Imagine having a digital travel journal that compiles your memories, photos, and itineraries. This is exactly what Polarsteps promises, an app favored by many globetrotters. But behind this enticing facade lies a different reality, highlighting worrying security flaws that could compromise your privacy.
Discovery of Polarsteps security flaws by Follow The Money
Chaque semaine, nous sélectionnons les solutions les plus utiles pour les professionnels du digital : IA, productivité, marketing, création de contenu et business. Voici les outils que nous recommandons actuellement.
☁️ pCloud – Le stockage cloud sécurisé avec une offre à vie.
Sauvegardez vos fichiers, photos et documents importants avec plusieurs centaines de Go ou plusieurs To disponibles.
→ Découvrir l'offre pCloud
🛒 Shopify – Créez votre boutique e-commerce sans coder.
Une solution complète pour lancer, gérer et développer votre activité en ligne.
→ Tester Shopify gratuitement
🤖 Jasper – L'assistant IA pour accélérer votre marketing.
Création de contenus, campagnes publicitaires et idées marketing : gagnez du temps grâce à l'intelligence artificielle.
→ Découvrir Jasper
🎬 CapCut Pro – Le montage vidéo dopé à l'IA.
Créez rapidement des vidéos professionnelles avec des outils avancés et automatisés.
→ Tester CapCut Pro
📊 HubSpot CRM – Le CRM idéal pour structurer votre croissance.
Gérez vos prospects, vos ventes et vos campagnes marketing depuis une seule plateforme.
→ Découvrir HubSpot CRM
🧠 MindManager – Organisez vos idées et vos projets efficacement.
Un outil puissant pour créer des mind maps, structurer vos stratégies et mieux collaborer.
→ Découvrir MindManager
🇬🇧 Gymglish – Améliorez votre anglais professionnel chaque jour.
Des cours personnalisés et courts pour progresser facilement, quel que soit votre niveau.
→ Profiter de l'essai gratuit
🌍 Preply – Apprenez une langue avec un professeur particulier.
Trouvez un enseignant adapté à vos objectifs et progressez à votre rythme.
→ Trouver votre professeur
Researchers from Follow The Money uncovered significant flaws in the Polarsteps app, revealing that users’ location data and photos can be easily retrieved. This discovery highlighted an unflattering aspect of the app, which is used by millions of travelers worldwide.
Despite the possibility for users to set their trips as private, the data remained accessible without prior authorization. Polarsteps’ API, lacking adequate access controls, allowed personal information to be extracted from a simple IP address.
Consequences for users and reactions from authorities
The implications of these discoveries are alarming. The exposed data includes names, home addresses, travel itineraries, and other personal details. This combination of information could be used for malicious activities such as harassment or identity fraud.
Following these revelations, the Netherlands decided to blacklist Polarsteps for military personnel. Belgian Defense Minister Theo Francken also took measures by banning the use of apps sharing location data near military installations.
Insufficient reactions from Polarsteps to the discovered flaws
Polarsteps seems to have been slow to take corrective measures. Although the company was informed of the flaws as early as fall 2025, it was only recently that it took steps to improve the security of its app. These actions include strengthening rate limiting, restricting outgoing data via the API, and requiring explicit authorization for sharing location data.
CEO Clare Jones stated that the company is committed to improving security, but this response seems insufficient given the scale of the problem. Users must now be cautious and reassess the use of Polarsteps to protect their personal information.
Broader implications for the security of travel apps
This case highlights a broader issue concerning the security of travel apps, which often collect a large amount of personal data. With the proliferation of such apps, it becomes crucial to ensure that companies comply with regulations such as GDPR and take necessary measures to protect their users.
Companies like Polarsteps must not only improve their security practices but also be transparent about the use of personal data. For example, Meta has already been sanctioned for similar practices. Increased oversight and stricter sanctions could encourage these companies to adopt stricter security standards.
FAQ on the security of Polarsteps and travel apps
What are the main security flaws of Polarsteps?
The main flaws of Polarsteps lie in the API, which allows unauthorized access to user data, including location information and photos, even if they are supposed to be private.
How did Polarsteps react to the discovery of security flaws?
Polarsteps took measures to improve security, such as strengthening rate limiting and restricting data shared via the API. However, these actions have been criticized as being late and insufficient.
What are the risks for Polarsteps users?
Polarsteps users are exposed to risks such as harassment, identity fraud, and burglary, due to the combination of personal information that can be exploited by malicious individuals.
What measures can users take to protect their data?
Users should carefully review the app’s privacy settings, limit the sharing of sensitive data, and stay informed about security updates offered by Polarsteps.