GCDroid and the PAF plugin use the following permissions:

Camera: permission is used to control the flashlight and allow taking pictures for upload with logs. No images are transfered to our servers, no data is collected.
Contacts: permission is used to access contacts to look up cacher name from the PAF plugin. No data is collected.

Neither GCDroid, nor the PAF plugin collect and/or store any kind of user data.