The maker of the app can send network requests, to themselves or any third party service they like, for every single action taken within the app: every launch, every click, every character typed, even every background refresh. They can include a unique tracking identifier to cross-reference these requests, they can further include any login/id information you’ve provided to the app, and they can include location information if the app has GPS permissions.

Even without GPS permission, IP geolocation provides them a rough track log, enough to say “user x was in california on monday, new york on tuesday, then new jersey for the remainder of the month”.

Pretty much anything except location tracking via GPS, unless the users clicks allow. So exactly the same as Google.