The app Statistics for Github (also "GitStat") uses Github Oauth (Firebase) for user authentication. As soon as you click the login button, you have to enter the login and password from your GitHub account. That allows the application to get data from your GitHub profile:
Profile (including all the personal info you have entered in your GitHub profile like country or e-mail)
Repositories (public and private)
Contributions grid
By defaule. the app asks for read:user access scope
A scope = "app permission" on your GitHub account in this context. Learn more about access scopes.
This scope allow app access all necessary information except private repos.
You can check "Private repos access" on login screen. This requires full repo scope:
While the repo scope is requested, the app doesn't perform any write operations on your Github account. Full repo scope is used only to display your private repository data and not to perform any "write" operations on your account.
This scope is requested as GitHub provides no readonly scope which allows access to private repos.
The app doesn't transfer GitHub access tokens to anyone and clears them after users sign out from their accounts.
The app doesn't store your GitHub account data anywhere outside the local storage of the app. That means all the data is physically stored only on your device.
All the fetched data is used only to create dashboards with some useful metrics about your account like:
Profile summary
Pie chart with programming languages of your repositories
List of your repositories with filters and sorting
Repository page
Contributions summary
Charts for contributions (types, count per day, contribution rate)
Contributions grid
The app uses the Firebase Crashlytics library to track crashes and maintain app quality. That means the app can collect your device's model, name and operating system and some other technical info related to the crash that happened. See https://firebase.google.com/support/privacy for more details.