Here's What You Need to Know About Polarsteps & Location Sharing

Sharing a vacation on social media is common. You can take a snap and directly post it on an app. Travel apps take that a step further by letting people record where they go and share their trips with others. For some families, this can also be a simple way to keep loved ones updated and let them know they are safe.

On the other hand, the amount of location information these apps can collect and share can also raise privacy concerns. Using a travel app can be a bigger consideration because service members’ travel history may show more than just where they went on vacation.

Follow the Money (FTM) reported that it was able to identify more than 30 military personnel and connect some users to military locations and possible home addresses through a travel app called Polarsteps. Here’s what we know so far.

What Is Polarsteps All About?

Polarsteps is a travel app that helps people keep track of their trips. Users can record their routes, add photos and updates, and share their travels with friends, family, or other users.

Polarsteps focuses mainly on travel and lets users document their journeys in one place. Users can also hide their live location, which keeps their current position and unfinished route from being seen by followers. Once the trip is complete, however, the full route can be viewed by people who have access to it.

Since the app can also track a person's location as they travel, this creates a record of where they have been. They also have several privacy options so that users can keep their trips private for their safety.

Follow the Money’s Concerns About the App

FTM looked at information available through Polarsteps and reported that it was able to collect a large amount of user and location data. The investigation also revealed that in order to access and bulk download this data, journalists were able to scrape data through an unsecured API that lacked basic protections.

The investigation identified more than 30 military personnel all over the world, including the United States, the United Kingdom, France, and Belgium. FTM journalists said they connected some users to military bases and likely home locations by piecing together information they gathered from the app.

FTM also followed some accounts that allowed anyone to follow them. This gave them access to trips that were available to those followers.

We reached out to Polarsteps about the investigation. Sara van Geloven, Project Manager for the app, clarified that

“All trip data that was never made public by the user has remained private, and no authentication was bypassed (i.e., no passwords were breached, and no one got access to any Polarsteps account or private trips).”

The investigation did not involve someone stealing a user's password or breaking into a private account. Instead, journalists were able to gather information that was available through the app and connect it with other information.

According to van Geloven, FTM used “public trip data, where users have actively chosen to share their trips and content publicly.”

She added that some profile information, such as a user's name, profile picture, and mutual followers, is publicly available on Polarsteps to help users find each other.

What Impact Did the Investigation Have?

The investigation led to action from international militaries. The Dutch Ministry of Defence took action to ban Polarsteps from all phones. Additionally, the Belgian Defence Ministry took to re-sharing its prohibition on using location-tracking apps near installations or during operations.

The report also highlighted specific OPSEC threats, such as photo geolocation, the ability for scrapers to identify installations and equipment through photos, and the ability for FTM to track the daily routines of Soldiers through long-term location-sharing data.

Polarsteps Privacy Settings

When we reached out to Polarsteps, they highlighted that the app

“allows users to choose who can follow them.”

The setting requires users to approve new followers before they can see trips shared with followers. Users can also change this setting to automatically accept anyone who wants to follow them.

Users can choose to make their trips public if they want to share their journeys with a wider audience. The company noted that some people, such as travel writers, choose to do this so they can share their journeys and itineraries with a wider audience.

Service Members Should Think Twice Before Sharing

The U.S. Army warns every service member and their families that small pieces of information shared online can be combined to create a track of their whereabouts. This is why a travel history is more sensitive for a service member.

Its social media guidance recommends turning off geotagging and location-based social networking and reviewing photos and posts for information that could reveal troop locations or other sensitive details.

Service members don’t need to stop using travel apps, as it’s their free will to do so. When they do, it is worth checking what information is being shared, who can see it, and whether location sharing is appropriate for the trip.

Service members should also follow any OPSEC guidance from their command, especially when deployed or working in sensitive locations.

Polarsteps also clarified that users whose trips have always been set to private or followers-only did not have their private information made public.

The company said, “Everyone whose trips have always been set to private or followers-only should not worry that their data, photos or private information has been shared publicly.”

Following the FTM investigation, Polarsteps said it introduced stricter API controls to limit large-scale access to public user data and strengthened protections around its secret-link feature.

Ultimately, Polarsteps is designed for adventure and leisure travel, not active missions. The company recommends that all users think carefully about their privacy settings before sharing their trips or allowing anyone to follow them.