There's a million things they can do. Permissions aren't that fine-grained, and the apps always have ways to infer a lot of stuff. Heck, they can even make background tasks, while if it's a website I know that if I close the tab your tool is gone.