While privacy policies are increasingly tailored to an app's actual data usage,* there are still FAR too many out there full of the same copypasta allowing a company to do whatever they want with your data. With that in mind, it's hardly a surprise that there's a disconnect between what engineers self-report and what's buried in the policies.

* Based on my own experience over the years actually reading them as someone who both cares about this stuff and works in the space.