re: Is there a way to spy on someone without an app?

Probably android lost.

It can be deleted by doing s factory reset unless he was smart enough to bake a custom ROM on her phone so that it comes back with the factory image.

I doubt he's that smart. Tell her to do a factory reset and change her email account password because he can reinstall it remotely on her device if he knows her email account.

She might end up having to change her email account on her phone if he set up the website to allow his phone number as a trusted remote install id.

What a creep.