It really depends. If, say, a password storing app stores data offline, you should look at the permissions list first to validate if it is indeed real. Normally, you wouldn't see that it would require an internet connection or your contacts, for one.
If it's an online service, check around and see if it really is their official app, or that they are a reputable service.
Of course, I can't really check right now, since I don't have my phone...