The app also sent an advertising identifier linked with the user’s phone to Google’s Firebase service. That adds up to “serious privacy risks,” Jumbo said.