Most of that is related to in app activities. You've conveniently left out the word "may". You don't have to agree to give them access to that stuff - my app does not have access to my location, my files or anything. Sure, they can track what I search for on the AA app, but they can do that on the site too. Not to mention that any web browsing that you do on their site while logged in can easily be tracked for identification, targeted ads, social media re-ads etc.

There's nothing that the app that lets them track you any more than being on aa.com does.