I'm generally against regulation on tech, but I think you should need to get a license to store location data anywhere aside from the users device. Approximate, say city level data may be fine. But there's a big difference between knowing Sam lives in Detroit vs knowing they visit St Andrews every Tuesdays.

This type of thing could lead to very real consequences.

Even if the API is secure, how many people have access to that data ?

Small part of me wonders if this isn’t a publicity tactic to make headlines for an otherwise unknown app.