While this is quite common, the only permission the AS Android app asks for is to access location services--which I've seen used in the form of giving me a notification with gate information when I arrive at the airport. Theoretically it could be turning on GPS throughout the day to see where I am and then sending that data back to AS, but between 1) AS's lack of fine-location-based marketing, 2) the fact that my phone says the app has used 0% of my battery since my last full charge, and 3) the fact that companies that want highly granular marketing are mostly just going to go through companies like Google and Facebook that are already collecting that data, I'm going to assume they're not.