Your cell company and Google aren't the only companies that could make that link.

Companies could link your identity and your phone together by your browsing habits, any other account from other services you've signed into, (e.g. tiktok if you used it before calyx, or any other email provider, search engine, news website, etc that you've visited), if you did any browsing on the same device before installing calyx, they could have gotten tons of browser fingerprinting information directly influenced by minute differences in your phone's hardware to others, or you could have just slipped up at one point and not had a killswitch on your VPN, so they were able to make a network connection outside your VPN before it managed to connect.

There's a million different reasons that could be why.

I'd say check if your VPN is set to block all network connections when it's off first, then think about if any account you use on your device now existed on a device with an OS prior to calyx, and prior to when you used a VPN. If the first is true, it's likely you just had a simple IP leak. If it's the latter, then that's just gonna be basic tracking from any number of data brokers. And if it's neither, then it's probably some form of behavioral analysis that linked your past activity to your present activity, or your general interests to those of people around you.