Their site is also intentionally crippled so you need the app to do some things. For example, to upload pictures, the primary function of the site...
And with the app comes the tracking and stealing of personal information, often using more or less dark patterns to trick the user.
From what I understand, an app that has no rights to pictures, contacts and location and so on, can still get info about the WIFI and put together a pretty good picture of your movements.
On Android, Location needs to be enabled for an app to access ambient wifi (scan of all nearby APs). On iOS, there is no API for ambient wifi, though their location API does use it behind the scenes.
On both iOS and Android, an app can access connected wifi even with location disabled.
And with the app comes the tracking and stealing of personal information, often using more or less dark patterns to trick the user.
From what I understand, an app that has no rights to pictures, contacts and location and so on, can still get info about the WIFI and put together a pretty good picture of your movements.