It's one of the troubling things about iOS (not an Android dev, so don't know from that end).

An iOS app needs explicit user permission to know your location, or to send you push notifications. It doesn't need to ask if it wants into your phone book and calendars.

Any app on the iOS App Store can read your phone book and calendars and do anything they want to this information. This is a mind-bogglingly gaping security hole.