As someone relatively ignorant about the mechanics of something like this, would it not make more sense that the app would be getting this data from the Android OS, with Google’s knowledge and cooperation?
The place I see the most unsettling ads (that seem to be driven by overheard conversation) tends to be the google feed itself, so it seems reasonable to me that they could be using and selling that information to others as well, and merely disguising how the data were acquired.