* Browsing history: If a user uses a WebView in your app, you can obtain the history of* that WebView instance.

Xiaomi phones let applications have access to the first (100?) bytes of each pcap line. [note: this is probably unintended, but their bug bounty programme didn't care].

* Keystroke patterns: You can track user keystrokes within your app. If you're a keyboard or accessibility provider, you can access keystrokes globally. I haven't used TikTok, but it's very unlikely that they do either of these, the UX to enable them is not pleasant because they're dangerous actions to take.

* Biometric identifiers: If a user takes a selfie, you have their iris/fingerprint/faceprint