I was initially confused about where this came from:
However, I see that in the screenshot you linked to.
The permissions at https://www.f-droid.org/en/packages/uk.org.boddie.android.weatherforecast/ only include these:
I don’t know why it says anything about the media collection. Maybe access to external storage automatically gives the app access to everything.
The app doesn’t do anything outside its own directory in the external storage. It creates a directory called WeatherForecast in the Download directory in external storage, where it writes a locations.txt file. This is where it keeps your favourite locations.
When the app starts, it reads the locations.txt file to find the locations to display in its main menu.
Ideally, I would remove the need to request these permissions. The problem has always been that the place data provided by yr,no was incomplete compared to what the website allowed users to search for. As a result, I wanted to let users add entries to the list, and I was too lazy to add that feature to the app when they could just edit a text file.
Now that all the queries go via api.met.no and require latitude, longitude, altitude rather than place name another update will be needed before too long.