I recently signed up for After pay. Which has an abysmal security requirements given a financial lending app. Which is a different story.

Now, when I logged into the app I noticed that they already grabbed my profile picture from google. This is the first time I noticed this happening. Did I authenticated afterpay to access my google public profile by agreeing to their terms ? How do they do that ? Is that even legal ?