

You literally have to establish cloud access first by registering an account or SSO then signing in before even using the app. Then you grant Bluetooth access. You can download the app and see right now.
At ANY point this company can collect your data or do any combination of things from the list I mentioned.
This is how every single IoT company works. This is the standard. You can even tell from the app that they used a shitty templating app that makes this app look the same compared to every other shitty IoT app.