The Polarsteps Privacy Investigation: How Droozi Limits Travel-Data Exposure

On September 4, 2026, Follow the Money reported collecting Polarsteps profile and travel information at scale. It described access to followers-only trips through accounts that automatically accepted followers, continued access through retained trip links, and precise photo locations available through the service's API.

Polarsteps disputes calling this a data breach. It says no passwords or accounts were compromised and trips not previously made public remained protected. The company acknowledges insufficient scraping limits and a secret-link weakness affecting some previously public trips later changed to followers-only. It says it expired historical secret links on August 20, strengthened API controls, and reset profiles to require follower approval.

The two accounts differ on how much private information was exposed. A privacy setting needs access controls that enforce it. Public information can also reveal more about someone when it is gathered across many trips.

Update, September 9, 2026: WNL reported on September 5 that a Dutch Defence spokesperson confirmed the ministry had added Polarsteps to its list of apps prohibited on defence devices. On September 8, Anadolu, citing Belga and the Belgian defence minister's spokesperson, reported that Belgium had reiterated its existing restriction on military personnel using geolocation apps on or near military facilities.

Before sharing a work trip, check your employer's rules for both work and personal phones. Choosing a private audience in Droozi or another app does not establish permission to share a work location. If a destination is sensitive or sharing is prohibited, leave it out. For an approved meetup, share only the details the people attending need.

A city and a date range are often enough to find out that a friend will be nearby. Leave out your hotel address, daily route and exact arrival time until someone needs them.

Droozi does not collect or store your live location or track you in the background. It stores the places and dates you choose for future locations. A precise venue or address can still save a precise point.

For future locations, you select an audience category such as Personal or Work. Check who belongs to it before sharing. Calendar travel suggestions open a draft for you to review and save. A suggestion alone does not publish a future location.

Future plans still deserve care. A date range can reveal when you expect to be away. Use a city-level future location when that is enough, and keep sensitive details within the smaller group that needs them.

New Droozi trips and events start in Private mode. For trips, the server excludes private and invite-only plans from discovery for unrelated users. Knowing a private trip's ordinary link gives an outsider a generic private-trip notice, not its itinerary.

Only owners, cohosts and members can open the detailed trip workspace. Being someone's contact or holding a pending invitation does not grant access. Requests to join a private trip need approval; invite-only trips require an invitation.

People can discover public trip overviews and join without individual host approval. Choose Public when you want broader participation. For a small travel group, use invite-only access and review the people you add before sharing accommodation or schedule details.

Droozi's account-required trip email invitations show a limited preview before sign-in. Anyone with the link can see the title, host display identity, cities, date range and a masked hint of the invited email address. Keep sensitive information out of the title as well as the description.

The recipient joins by signing in or creating an account with the invited email address, claiming the invitation and accepting it. Claiming alone leaves the invitation pending. The preview excludes the full itinerary, member list and lodging details.

Hosts can revoke pending email invitations, and the links expire. Remove someone who has already accepted through the trip's member controls. These rules apply to account-required trip email invitations. Other sharing features, including guest event RSVP links, have their own access rules.

Suppose you are visiting Chicago for a conference and want to meet a few friends. Share your available dates with the people you want to see. Once you know who is coming, add the smaller group's detailed plan.

Changing a public Droozi trip to Private does not remove existing members. Someone who joined while it was public may still have access afterward. Review the member list separately; changing visibility does not clear the guest list.

A copied photo URL may remain accessible after the trip's privacy settings change. Changing the trip's audience does not reliably revoke a shared image link. You also should not assume that every photo has had its location metadata removed.

Recipients can save screenshots, copy text, or forward information they were allowed to see. Droozi's privacy policy acknowledges that shared information may be saved or shared again. Public content can be collected too; access controls do not make a service immune to scraping or security failures.

Droozi limits exposure through your sharing choices and access checks for protected trip details. Before adding sensitive information, consider who can open the plan and who may already have a copy.