I don't know how this was done, but traffic could presumably be intercepted by using a proxy and installing the certificate for the proxy on the device - you ha

I don't know how this was done, but traffic could presumably be intercepted by using a proxy and installing the certificate for the proxy on the device - you have a secure connection from the app to the proxy and a separate secure connection from the proxy to the servers but the proxy gets to see all traffic in the clear.