On modern phones, it will tell you if it’s using them. And you can block permissions.

however, given who is the owner, right now the best course of action is to consider xitter as a compromised app and treat it as malware/spyware