This depends on what data protection laws apply, if any. For purposes of this answer I will assume that the GDPR applies, either because the app operator (who may or may not be the same as the developer) is located in the EU or UK, or because the operator has "targeted" a jurisdiction where the GDPR applies, and at least some of the users a located in such a jurisdiction. Another data protection law may apply instead, in which case the rules will be more or less different. In some cases no such law will apply at all.
Under the GDPR, and particularly under Article 6, the Data Controller (DC) must specify the purpose of, and a lawful basis for, any processing of Personal Data (PD) Paragraph 1 of Article 4 defines personal data:
"personal data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ...
That would include "user data", the user's IP address, and other information that is related to the user, including the user's choices and activities while using the app.
A plausible basis might well be item (b):
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject ...
Or it might be item (a), consent. The other possible lawful bases do not seem likely to apply in the situation described in the question.
Informing the Data Subject
Under article 13 and article 14 of the GDPR, the DC must provide a variety of intimation to the DS whenever PD is collected, either from the DS or from a third party. This includes the purpose(s) of the processing as well as the lawful basis. It also include who is going to receive the PD, and whether it will be transferred to a third country.