The .app TLD became available to register in May 2018:
Introducing .app, a more secure home for apps on the web
Today we’re announcing .app, the newest top-level domain (TLD) from Google Registry.
Starting today at 9:00am PDT and through May 7, .app domains are available to register as part of our Early Access Program, where, for an additional fee, you can ...
I have not seen anything on the official registry websites that addresses the issue explicitly. Some TLDs explicitly prohibit the practice and also the leasing of domain names to third parties (I seem to remember .ca is an example).
From their website:
The registration of a domain name in the ccTLD .it is permitted only
to persons who have citizenship, ...