Where do they see the api information
Reverse engineer the app with apktool, you will get all files. just go to smali > com > yourpackage>name > Config.smali
you will see your server and api information.. anyone can use that information to build an app and link it to your server instead of him making one.