system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: When a phone app asks for permission to access your contacts, identity, etc. what data can they get from your phone?
gpt
Potentially ALL of the information within the categories they are requesting and in some cases more than that.  You are trusting that the creator/company is only accessing the info to for use within the program but most agreements only imply this is the case.

Its within the realm of possibility that a downloaded additional keyboard can record key entries, that photo editing apps upload/save your images to their servers, that additional camera apps could activate/record from your camera when you did not intend it, the list goes on.

The apps are supposed to go through testing before being allowed to be published to the market, but where is the line on what you have agreed to in a user agreement you didn't read or additional content downloaded in an update or through the app itself after installed?

Malware detecting software can only detect methods which are already known to exist... Inevitably someone is always a guinea pig.