alt Hacker NewsThat would be my intuition, but can you elaborate what specifically the app (if not given extra permissions) can do? Assuming the user doesn't change settings, web sites (at least if used semi regularly) can store a persistent cookie, so keeping the user identified is possible with both.
The only thing I can think of is regular background pings to track the user through IP geolocation.
Unpermissioned access to all sensors like battery, acceleration. Hardware IDs. Background pings (as you said). Push notifications. Seeing which other apps are installed (maybe, I think that one got locked down). All kinds of fingerprinting.