Polarsteps Banned on Dutch Defence Phones Over Location Risks

What Is Polarsteps?

Polarsteps is a travel-tracking app founded in Amsterdam. It uses a smartphone’s location services to record a user’s journey and display it as a route on a map. Users can add photographs, notes and locations and share their trips with other people.

The app is designed to make travel memories easier to document. But precise location information can also reveal sensitive details about a person’s routine, including where they live, work or regularly spend time.

That is particularly important when a location trail is updated while someone is travelling rather than being shared only after they return home.

What the Follow the Money Investigation Found

On 4 September 2026, Dutch investigative journalism platform Follow the Money reported that Polarsteps travel data could be collected on a large scale through the app’s data interface.

According to FTM, journalists were able to access information connected to almost 2 million trips, including approximately 230 million photographs and videos and around 1 billion GPS locations. The investigation said the data could in some cases be followed close to real time.

FTM also reported that trips that users believed were restricted could still be accessible through the system it investigated. The journalists said they were able to use repeated location points to identify places where people regularly stayed, potentially allowing a home address to be inferred.

The investigation is significant because location data can reveal much more than a holiday destination. Repeated GPS points can create a detailed picture of someone’s movements and daily routines.

Polarsteps has disputed the characterization of the incident as a traditional data breach. The company said the journalists accessed travel information that users had made available and that passwords or private credentials were not stolen. Polarsteps also said it had introduced additional measures to prevent large-scale automated data collection.

How Soldiers Were Traced to Their Homes and Missions

A second FTM investigation, published on 5 September, focused on military personnel using Polarsteps.

FTM reported that dozens of service members from the Netherlands, the United States, the United Kingdom, France and Belgium could be identified through a combination of Polarsteps information and other publicly available data.

According to the investigation, some travel routes could be connected to private homes, military bases and overseas missions. One example involved a service member whose travel from Austria was later connected to a NATO mission in Lithuania.

The concern is not simply that someone posted a holiday photograph. A detailed location history can reveal patterns over time: where someone lives, when they travel, which military facility they visit and when they return.

For military personnel, that type of information can present a significantly greater security risk than it would for an ordinary holidaymaker.

Why Dutch Defence Banned Polarsteps

Following the investigation, the Dutch Ministry of Defence confirmed that Polarsteps would be placed on its blacklist for official Defence devices.

According to reporting by NOS, the app will no longer be available for installation on Defence phones and will be removed from devices where it is already installed.

The measure applies to official Defence devices. It does not mean that every Dutch resident or every soldier is legally prohibited from using Polarsteps on a privately owned phone.

However, the decision is an important warning about the risks of location-tracking applications on devices used for sensitive work.

Dutch Defence has previously restricted other applications that can expose detailed location patterns around military facilities. The Polarsteps case shows that the same risk can exist in applications designed for travel rather than fitness or military use.

What Polarsteps Says

Polarsteps rejects the idea that the investigation uncovered a conventional breach in which confidential passwords or protected accounts were stolen.

The company said the information accessed by the journalists was travel information that users had made available through the platform. It also said that no passwords or private credentials were compromised.

At the same time, Polarsteps has acknowledged the scale of the data collection described by the investigation and says it has strengthened its systems to prevent automated scraping.

FTM and Polarsteps therefore describe the incident differently. FTM focuses on the ability to collect large amounts of location information, including information associated with trips users believed were restricted. Polarsteps disputes the characterization as a traditional data leak and says security controls have been improved.

Users should therefore check the current privacy and visibility settings in the app rather than relying on settings they selected in the past.

What Does This Mean for Travellers and Expats?

Most Polarsteps users in the Netherlands are not military personnel. For ordinary travellers, the risks are different but still worth considering.

1. Your home address can potentially be inferred

A travel app does not need you to enter your home address for someone to identify it. If the same GPS location appears repeatedly, especially overnight or at the beginning and end of journeys, it may be possible to work out where someone lives.

2. Real-time travel information can reveal that your home is empty

If a journey is publicly visible while you are abroad, someone may be able to determine that you are away from home. This is one reason security experts have long recommended being careful about sharing live holiday information.

3. Photos can reveal additional information

Photographs can contain location information depending on how they were created, stored and uploaded. A photograph taken near someone’s home can therefore provide another clue about their location.

4. Children and family routines can also be exposed

Repeated location information can reveal more than the traveller’s movements. Family trips, regular destinations and other recurring locations may become visible through a detailed travel history.

For expats living in the Netherlands, there may also be an additional privacy concern: a single account can contain travel between a Dutch home and a family home or regular destination in another country.

How to Protect Your Polarsteps Privacy

You do not necessarily need to delete Polarsteps. But after the recent investigations, it is sensible to review what information you are sharing and who can see it.

• Review old trips: Check journeys that are still visible and consider hiding or deleting routes that reveal your home or workplace.
• Check your visibility settings: Review which trips are public and which are visible only to followers.
• Review your followers: Remove accounts you no longer recognise or want to share travel information with.
• Turn off tracking when appropriate: Avoid continuously recording your location when you are not actually travelling.
• Be careful with live updates: Consider sharing travel information after returning home rather than while your property is empty.
• Review photo location settings: Check whether your phone and apps are attaching precise location information to photographs.
• Use extra caution for sensitive jobs: People working in Defence, law enforcement, diplomacy or other security-sensitive roles should follow their employer’s specific device and location-data policies.

Users should not attempt to reproduce the technical method described by journalists to test whether the old system is still accessible. Any remaining security questions should be addressed through Polarsteps, the relevant authorities or independent security researchers.

✅ Polarsteps Privacy Checklist

If you use Polarsteps in the Netherlands, take a few minutes to review these settings:

📚 Sources

This article is based on reporting published by Follow the Money and Dutch news organisations on 4 and 5 September 2026. The article does not independently verify the technical findings of the investigation.

• Follow the Money, 4 September 2026:
  Investigation into the large-scale collection of Polarsteps travel data, including GPS locations, photographs and trips.
• Follow the Money, 5 September 2026:
  Investigation into Polarsteps data being used to identify and follow military personnel.
• NOS, 5 September 2026:
  Reporting on the Dutch Ministry of Defence’s decision to blacklist Polarsteps on official Defence devices.
• NRC and RTL:
  Reporting on the investigation and Polarsteps’ response regarding the data collection and security measures.

Important: Polarsteps disputes the characterization of the incident as a conventional data breach. The company says passwords and private credentials were not stolen and that additional measures have been introduced to prevent large-scale automated collection.