Related: if you register for push notifications, Apple/Google have a habit of sending you the same push token as you received on that device previously. It's not guaranteed (and should be insufficient for login), but this does make it possible to track users across app reinstalls.

Its possible they leave a persistent cookie on your device, even after 'deleting the app'

It has USB media access and thus can edit your files. They probably choose not to delete that data during uninstall.

if you sign in with your facebook / twitter account it uses the system-wide ios facebook / twitter credentials which aren't deleted when the app is removed