First of all, the Pokémon Go software is an app for hand-held devices such as smartphones, tablets and the likes, not for PCs or similar machines. And what it does have access to, is your GMail account, if you have one. This includes any and all contacts you have stored in the address book of your GMail account. But it does not have access to anything beyond that.
What is also true, is that the Pokémon Go software absolutely requires making use of the GPS functionality of your smartphone, because it needs to be able to map your physical whereabouts onto the virtual reality map with the whereabouts of the Pokémon you must find, so as to create the augmented reality experience which is at the core of the game. And of course, this means that Pokémon Go players can at all times be tracked while they are playing the game — which, considering the madness and addiction that the game has brought about, pretty much means 24/7.
Another thing which is true — albeit that it's only sideways related — is that there is a fake Pokémon Go app circulating at the moment, which is only masquerading as the real game, but then locks your screen and demands that you pay a certain amount of money into some sinister account — probably by way of Bitcoins. In other words, it's ransomware, but this app does not come from the makers of Pokémon Go and does not function for playing the game. It simply disguises itself as the official Pokémon Go app when you install it and then locks up your device when you start the app.