Its software running on your phone my dude, theoretically it has access to anything your phone has access to. Without looking at the code, it could take pictures of you through your phone camera. A VPN is for external websites, not programs you run for yourself.