Android app spies on tens of thousands of phones