"Cocospy is a web-based app for target iPhones or iPads. Instead of monitoring the device itself, it monitors the iCloud backup, which usually gets updated every time the device is plugged in and has WiFi access. Cocospy needs the iCloud credentials of the target device to work. Because it works with the iCloud backup, it's impossible to detect. You can also set up Cocospy 100% remotely."

It claims to do so by having a willing user install it and grant any permissions it asks for, not really impressive.

On iOS it's having you disable 2 factor auth and letting it into your iCloud account, which

a) relies on you having access to the same iCloud account as the target and

b) gives them access to your data and weakens your account in what is probably the intended use case, shared accounts