Clients see everything decrypted so it can be a threat if someone put malicious code in damus 

 What you mean with “everything “? 

 Your private key and all of your DM's basically. Everything else is public anyway.  

 What about my phone, browser data? 

 they would vary app by app. you usually have to allow such permissions 

 I doubt this. 

 That's how phone permissions are supposed to work but Facebook still spying on users with microphone lol 

 What other can do an app? Spying browser history? 

 Anything
Contacts 
Messages  

 If Facebook can do this, any app can do this. Damus can do this too.