Google promised its contact tracing app was completely private, but it wasn’t