I think you misunderstand what the sandbox of the operating system does. An app cannot start tracking you 24/7 just because it's sideloaded.