TL;DR: the app does nothing out of the ordinary for a messaging app, which is why it’s so nefarious. It uploads contact information and location data…but after asking the user’s permission for seemingly legitimate reasons. The danger is that it’s hard to know what they’re doing with the uploaded data.