Depending on permissions, just about everything.

The more worrisome of these would be all your contacts, your location (even with Location permissions denied it can still be extrapolated up to a point if allowed to access to information on “WiFi networks nearby”) - which can be used to derive workplace, living place, hobbies and, when crossed with other people’s data, even who you regularly meet with - call history, files in your phone (such as personal photos and stuff you downloaded), sites visited and, even more seriously, actually record what’s being said around your phone and even image as well as track something as intimate as how your phone (and hence you, if its in a pocket) move and when.

All of this is beyond the whole tracking of app usage (what do you do, see and for how long in it) which at least makes some sense to track for quality improvement.

That said, what makes it a problem is not that the app can get that infomation from the phone’s systems but that it can, without your authorization, send it all to a central server - if it couldn’t do the latter all that data capture for processing inside your phone would be absolutelly fine.