The app can access your phone's data, plus any databases connected to your phone. So they get your contacts, addresses, phone numbers, pictures, and more. They can then sell that data for profit. It's basically a semi-legal phishing scheme, and a huge pain in the ass for anyone who works in data security. One idiot puts an app on their phone, and next thing you know China somehow beat you to producing whatever product your company spend millions of dollars designing and testing.