Go look at the permissions for any app before you install it. They all have them listed. Most don't have access to your contacts or many of the unneeded permissions this app has. It's not a messaging app or anything like that. And I looked at the permissions for another app that claims to do the same thing but they don't want access to your contacts. Neither did another dozen or so marijuana related apps on the google play store.
And it's not the phone asking for those permission it's the app asking so you're giving some company access to the contacts list on your phone. An app that supposedly determines THC content by using a couple pictures needs access to a users contacts list? The contacts list has nothing to do with the installation or functionality of the app or it's purpose.
That data can be downloaded and you gave permission when you installed the app. Believe it or not many apps are mining that data which ends up in databases that are sold just like email lists. One of the reason people get spam calls and text messages on their phones. Someone installed an app that mined their contacts list and you were in it.
Then there's the fact that anyone downloading the app is probably growing weed. Installing an app that can potentially harvest your contacts is probably not the best thing to do especially if you live in a non-legal state.
Their privacy policy even states that information provided by you may be stored on your device as in your contacts list. Those permissions are set by the developer so they intentionally wanted access to your contacts when they made the app.
12. Privacy.
We will use any personal information that we may collect or obtain in connection with the App in accordance with our privacy policy which is available on our website,
https://www.gethigrade.com, as well as in the "settings" section of the App ("Privacy Policy"), and you agree that we may do so. Notwithstanding, you are aware that you are not legally obligated to provide us personal information, and you hereby confirm that providing us personal information is at your own free will.
Please also be aware that certain personal information and other information provided by you in connection with your use of the App may be stored on your Device (even if we do not collect that information). You are solely responsible for maintaining the security of your Device from unauthorized access.