That's a good point. I think those were included by default by the app development framework that I'm using (Expo for React Native).
I've removed those permissions, and pushed a new version to the Play Store. It will take some time to get reviewed by Google. In the meantime, you can access the APK from this link:
https://drive.google.com/open?id=1ERMwBIKwScsnJ2OHP7wbljVJLjUOsxe2
Here are the permissions that it currently requests:
package: com.aurelius.app
permission: com.aurelius.app.permission.C2D_MESSAGE
uses-permission: name='com.aurelius.app.permission.C2D_MESSAGE'
uses-permission: name='com.google.android.c2dm.permission.RECEIVE'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='android.permission.INTERNET'
uses-permission: name='android.permission.SYSTEM_ALERT_WINDOW'
uses-permission: name='android.permission.WAKE_LOCK'
uses-permission: name='android.permission.LOCATION'
uses-permission: name='android.permission.CAMERA_ROLL'
uses-permission: name='host.exp.exponent.permission.C2D_MESSAGE'
uses-permission: name='android.permission.MODIFY_AUDIO_SETTINGS'
uses-permission: name='android.permission.RECEIVE_BOOT_COMPLETED'
uses-permission: name='android.permission.REQUEST_INSTALL_PACKAGES'
uses-permission: name='android.permission.STORAGE'
uses-permission: name='android.permission.FOREGROUND_SERVICE'
uses-permission: name='android.permission.ACCESS_WIFI_STATE'
uses-permission: name='com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE'