The application collects biometric data, such as fingerprints or facial recognition data, but the privacy policy fails to disclose this. Biometric data used for unique identification is typically considered a special category of personal information under privacy regulations like GDPR due to its sensitive and unchangeable nature. Not informing users about this collection can be misleading and may violate legal requirements for explicit consent and transparency.