An app(lication program) is software run on the end-users machine. That does not fall under the GDPR.
Any processing (including storage) you do on user data has to be compliant with the GDPR.
- Allows a user to authenticate via e.g. Facebook and stores some basic data (optional)
Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data.
Providing this "basic data" as a JSON or CSV file should meet data portability requirements.
- Allows a user to upload a GPX file (a route or some other activity)
- Stores the above file to Google's database
- Allows the user to analyze that file.
Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent).
Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data.
Finally, make sure there is a "Close my account and delete all my data" option.