I actually read the policy on the free one I was using, which took about forty minutes and a coffee. It permitted sharing de-identified transaction data with unspecified partners for analytics, and there was no way to opt out and keep using the app.
I cancelled, moved to something I pay for, and revoked the connection at the aggregator. I don't think I was in danger. I just decided that if my grocery patterns are a product, I'd rather be the customer than the inventory.