looped_around The app is subject to the permissions framework you choose to run it on, if it's the Android App, then it'll need relevant permissions from the OS itself, and if it's on Vanadium, then it needs permission from the browser, which in turn needs permissions from the OS.
As for analytics, apps in general decide what they do or don't send to the backend service and there's no real way to guarantee they aren't logging what you do. Using your FB example, the app necessarily sends your posts, likes, and such to the backend, which then can or cannot log that into analytics. This last part is happening entirely on their server and thus cannot be influenced by us as users.