Short answer: You can't.
There's a famous paper Reflections on Trusting Trust by Ken Thompson about how the compiler itself could be inserting the malicious code, including when compiling itself.
The best way would be to build the app yourself, or have it built by some entity you fully trust for this. Maybe you don't have the knowledge or tools yourself, but have a friend who is able to do that. Or you have the monetary means to hire someone which does this for you.
(Note all of this is easier for the Android version, doing the same for iOS apps would be harder, since it is only possible to install from the official App Store. In order to install an unofficial version you would need an Apple developer certificate or a jailbroken device)
One could also install it from a third party, such as from https://f-droid.org repository (it doesn't seem to be there currently, but since the app is AGPL, it could be added¹). That moves the trust from "the developer build the published app from the given code" to the third party running the repository.
As mentioned by MadHatter, there is a trend for reproducible builds, which really helps trust issues (but is harder to achieve). Usually, different compilations of the same code will not result in the same binary, even when using the same version of libraries, compiler, target, etc. Often, there are changes such as timestamp or the order of files which result in slightly different resulting binaries. We talk about a reproducible build when different people reach to the same program. If you installed an app from source X and hash 9dfd069921782a66fe0b52eae6c20fa75e669cff, but the same program, built from the same code by other unrelated people also result in the same program with hash 9dfd069921782a66fe0b52eae6c20fa75e669cff, that strongly hints that the result of compiling that code is the given program (or a conspiracy between them!). That would even allow you to compile it post-facto and verify that the program you installed with hash 9dfd069921782a66fe0b52eae6c20fa75e669cff is the same you obtained when compiling it yourself a week later (although, if it didn't match, it might have already done its evil wrongdoings).
Even if you don't directly use an unofficial built, that they publish the code has two other benefits to take into account:
First of all, they are more incentivized to play fair. If their app sent home a copy of your contact list, by itself that would be bad. But if they claimed that the code is [1] and then modified the application to additionally send them a copy of your contact list that would be much worse. Not only would they be doing that (for which they might come up with a reasonable explanation) but also purposefully concealing their wrongdoing lying about the code!
Could they do that? Yes, technically they could. But also, the blowback (if found) could be devastating.
Second, the risk not only lies in the potential modifications added on the compilation step, but also in the original code itself. By opening their code, that for review by other people, they are more clear about what they it is doing (including potential bugs or unintended security issues). It still doesn't help if nobody reviews the code and finds them, but the theory is that, eventually, someone would hopefully find them. This should also make the developers a bit more aware when coding the app.
¹ At least in theory, it might have problematic dependencies.
