Apps require permissions to operate smoothly. The permissions you give allow the local app installed on your phone access to some resources on your phone. These resources are accessed by the Haystack app installed on your device, but the data isn't sent to our servers unless absolutely necessary.
Permissions (in more detail):
Contacts – enables the sync of your Haystack contacts to your phone's contacts
Photos/media/files/storage/SD – enables the app to import an image from your gallery when you want to do so (and make your business card look awesome)
Camera – so you can scan business cards you receive from others