Thanks for sharing. I tried to read it and found nothing alarming there. I mean, gymrun can export to gdrive and Dropbox, to do so it will need to ask and use an access tokens for these services, to check a subscription status it needs to communicate with Google. probably, to deal with wearos and Garmin watches, to sync with Samsung health app few more permissions are needed.

And obviously, crash reporting needs some info about the device.

Ps: link to the privacy policy is provided in the app "page" in the Google play store as well.