The policy does not make that distinction. An app generally needs a backend and it is clear some of the policies are directed towards not the app itself but ho

The policy does not make that distinction. An app generally needs a backend and it is clear some of the policies are directed towards not the app itself but how it interacts with the backend. These same guidelines are meant to be used to stop apps such as malware games that collect contacts and send them to the backend to be used as spam email lists.