> How did the app […] identify people in them without my explicit permission?

I would guess you tagged them in the Photos app and gave them a name, and possibly coupled to them to a contact in Contacts.app.