Millions of Polarsteps users, a popular app among travelers, are exposed to digital security risks. Researchers have discovered that flaws in the app allow unauthorized access to sensitive personal data, raising major concerns about privacy protection. The company, although aware of these issues, is slow to respond effectively.
The key takeaways
- Polarsteps, a travel app, has security flaws that expose the personal data of millions of users.
- The app’s API flaws allow unauthorized access to sensitive information, including location data and photos.
- Dutch authorities could sanction Polarsteps for non-compliance with personal data protection standards.
You have probably dreamed of sharing your travel adventures with your loved ones in a simple and captivating way. Imagine having a digital travel journal that compiles your memories, photos, and itineraries. This is exactly what Polarsteps promises, an app favored by many globetrotters. But behind this enticing facade lies a different reality, highlighting worrying security flaws that could compromise your privacy.
Discovery of Polarsteps security flaws by Follow The Money
Researchers from Follow The Money uncovered significant flaws in the Polarsteps app, revealing that users’ location data and photos can be easily retrieved. This discovery highlighted an unflattering aspect of the app, which is used by millions of travelers worldwide.
Un vide-dressing occasionnel rapporte rarement plus de 200 € par mois. Mais l'écart avec les vendeurs les plus performants est plus large qu'on ne le pense : 300 à 900 €/mois pour une activité régulière (2 à 5h/semaine), et 1 000 à 2 500 €+/mois pour les profils qui traitent Vinted comme un vrai canal de vente structuré. La différence ne tient ni à la chance ni à la taille du dressing de départ : elle tient presque entièrement à la méthode (algorithme, pricing, réactivité) appliquée avec régularité.
Avec 📘 Le Guide Vinted, transformez ce canal en revenu complémentaire structuré, voire en une vraie activité e-commerce.
Une méthode complète pour décoder l'algorithme, optimiser vos annonces comme une landing page, automatiser votre relance commerciale et sécuriser votre activité sur le plan fiscal.
🧠 Les 5 facteurs qui pilotent la visibilité de vos annonces (logique proche du SEO)
📈 Une méthode réplicable pour passer d'une activité occasionnelle à un revenu récurrent
⚖️ Statut, fiscalité, professionnalisation : rester en règle en montant en volume
🚫 Le chapitre que personne n'aborde ailleurs : comprendre et prévenir les blocages de compte
Despite the possibility for users to set their trips as private, the data remained accessible without prior authorization. Polarsteps’ API, lacking adequate access controls, allowed personal information to be extracted from a simple IP address.
Consequences for users and reactions from authorities
The implications of these discoveries are alarming. The exposed data includes names, home addresses, travel itineraries, and other personal details. This combination of information could be used for malicious activities such as harassment or identity fraud.
Following these revelations, the Netherlands decided to blacklist Polarsteps for military personnel. Belgian Defense Minister Theo Francken also took measures by banning the use of apps sharing location data near military installations.
Insufficient reactions from Polarsteps to the discovered flaws
Polarsteps seems to have been slow to take corrective measures. Although the company was informed of the flaws as early as fall 2025, it was only recently that it took steps to improve the security of its app. These actions include strengthening rate limiting, restricting outgoing data via the API, and requiring explicit authorization for sharing location data.
CEO Clare Jones stated that the company is committed to improving security, but this response seems insufficient given the scale of the problem. Users must now be cautious and reassess the use of Polarsteps to protect their personal information.
Broader implications for the security of travel apps
This case highlights a broader issue concerning the security of travel apps, which often collect a large amount of personal data. With the proliferation of such apps, it becomes crucial to ensure that companies comply with regulations such as GDPR and take necessary measures to protect their users.
Companies like Polarsteps must not only improve their security practices but also be transparent about the use of personal data. For example, Meta has already been sanctioned for similar practices. Increased oversight and stricter sanctions could encourage these companies to adopt stricter security standards.
FAQ on the security of Polarsteps and travel apps
What are the main security flaws of Polarsteps?
The main flaws of Polarsteps lie in the API, which allows unauthorized access to user data, including location information and photos, even if they are supposed to be private.
How did Polarsteps react to the discovery of security flaws?
Polarsteps took measures to improve security, such as strengthening rate limiting and restricting data shared via the API. However, these actions have been criticized as being late and insufficient.
What are the risks for Polarsteps users?
Polarsteps users are exposed to risks such as harassment, identity fraud, and burglary, due to the combination of personal information that can be exploited by malicious individuals.
What measures can users take to protect their data?
Users should carefully review the app’s privacy settings, limit the sharing of sensitive data, and stay informed about security updates offered by Polarsteps.