I am not sure that this is the case.

The app had access to data about the friends of its participants.

AFAIR that included attributes that were set “friends-only”.