In the background and without warning, they also obtained the phone number and a unique identifier of the infected device and sent the information in clear text

In the background and without warning, they also obtained the phone number and a unique identifier of the infected device and sent the information in clear text to a remote server under the control of the software developers. Is this abnormal behavior for a mobile app? Hell, wasn't Path uploading your entire address book to its' servers? Oh, I guess that's different because it was over SSL.