If by "spy app," you mean it broadly enough to include any malware capable of stealing your info, then yes one would be needed to do so. Your phone doesn't randomly send info to hackers.
The bigger question is, do you suspect you've been hacked? If so, what are you specifically experiencing leading you to this conclusion? If you create an account here, you'll be able to reply to this thread and then we can give you more specific answers.
EDIT: There is one way to get your info without an app. Not having a lock screen setup and allowing someone unfettered physical access to your phone.