The app read your address book — names, numbers and emails of people who never agreed to anything. Contact lists are the classic seed for social-graph building.
iOS records every access to this resource in the device's own App Privacy Report — a count of accesses, never the content. The evidence below comes from donated reports: every row was reported by at least 3 separate accepted donations and published under a human verdict (later rows for an approved app inherit its verdict). Access counts reflect the donors' usage; access times are never collected.