The apps runs for about a couple of minutes. The only way it can be sending data is over WiFi (I've seen it running on a friend's phone who didn't create a second user). The phone had gigs of data.
So it might be collecting sensitive data but surely not dumping the whole content of the phone.