You can install an application like Flatseal (flathub.org/apps/com.github.tchx84.Flatseal) to inspect the permissions for a flatpak.

How locked down a flatpak is depends entirely on the developer and what permissions they request. By default, they can’t really see much. For example, they can’t even see the processes running on your host or your user and system files.

Flatpak does not do anything about network access though, it can only do no access or full access, no in between. The data they can collect on Linux in a Flatpak is very limited but it does not prevent them from calling home.