Themble It has the same privacy implications as any other app. Since it's put in the regular app sandbox, it needs explicit consent through permissions to access sensitive information such as your location, files, and contacts. You can also revoke sensors and network access through GrapheneOS's added permissions.
What Play Services does with the information you give it is up to itself and can change over time. Google's privacy policy is probably the best place to see how they handle that data.