If I had to take a guess they're using something like Phonegap/Cordova (i.e., this is a hybrid mobile app -- basically just a browser view with HTML content and JavaScript that can make use of the device's hardware and accounts). A common mistake I've seen is people using the stock Android manifest that comes with Phonegap/Cordova. This manifest enables ALL permissions so all the native functionality plugins "just work" out of the box. However, you're supposed to pare down the manifest to remove permissions for things you don't actually use so you don't end up in this situation.