Before you install an app, from the App Store or an install link, Tringify shows everything it will be able to do in your store. The list comes from the reviewed version you are installing, so the app can't do more than it shows.
What the install screen lists
Store data: each kind of data the app can read, or read and change, such as products, orders or customers. An app that asks for none shows that it doesn't request access to protected store data.
Storefront: the blocks it offers for your theme, the embeds and pixels it can add to your pages, and the shopper consent each pixel waits for, such as analytics consent. Nothing is added to your pages until you place or turn it on.
Shopper activity: the storefront events the app receives, such as products viewed or purchases, and the consent each needs.
Custom fields: the fields it adds to products, variants, orders or customers.
Services: whether it can be your payment, SMS, WhatsApp or fulfillment provider. Some need you to connect your account with the provider first.
Plan: the plan you choose, if the app has plans. See App plans, usage charges and requests.
Who can install
Staff need permission to manage apps, and can only install an app whose access is within their own permissions: someone who can't edit products can't install an app that changes products. The store owner can install any app. Payment apps come only from the App Store.
After installing
The app keeps exactly the access you approved. If a later version asks for more, you approve it before the update takes effect; see Update an app. Every app's privacy policy says what it can access and how it handles your data; see App privacy policies, terms and documentation.