Someone from reddit found some disturbing things through reverse engineering as well: https://old.reddit.com/r/videos/comments/fxgi06/fmuko1m/

The app resists reversing, and even slightly modifies its behaviour when reversing is detected, and at least the Android version had blatant RCE capabilities.

This is on top of collecting everything it possibly can about the device. I'd presume if you give it the photos permission (which is extremely broad on both mobile platforms unfortunately), it will scrape what it can from there as well, which might include historical location data.