As an example, the one used in Singapore is open source and implements a public standard (bluetrace.io), so you don't even need to trust them, you can check it yourself. And before you ask, yes, people have decompiled the app to verify this.