That's not a privacy violation. Her data wasn't collected, a series of numbers was tagged. The person tagging the number could be entering the tag as anything they want.
I think what you mean to say is that it is not the app that committed the betrayal, it was the source who was enabled by an app that otherwise had a non-nefarious purpose. Which, fair point, but I don't think the article would disagree.