A popular flashlight app sold millions of Android users’ location data to advertisers and they had no idea