SpamSieve is designed to only request the minimum permissions needed. For example, it does not request access to Apple Mail’s data if you are using a different mail client. However, if you are using Mail, SpamSieve does need access to Mail’s data. The way macOS is currently designed, there is a single permission called Full Disk Access that encompasses Mail, Safari, and Time Machine. It’s not possible to grant one without the others.
If you have Use macOS Contacts checked, SpamSieve will read the addresses of your contacts in order to help decide whether the messages are spam. This is controlled by the Contacts privacy setting in System Preferences. SpamSieve does not store this data anywhere. SpamSieve does not transmit any personal information back to us, and no data is ever sold. There is more information in the privacy policy.