You said it was their app correctly?

Have you validated that they didn't take the other bits off your phone?

Every modern smartphone has permissions on that stuff for years now. I don't self-peasantize with "but what if..."