Before getting the user's data from a thing, a procedure called link thing is necessary, which allows the platform to know that the user is the owner of the thing.
This procedure needs a thing token (or the thing ID) and a session token. And it requires some kind of direct communication between the app and the thing. For example, when setting up the network for the thing and the SSID and password are sent to the thing, it is a good moment to ask for the thing token of the thing. With this thing token, the app will be able to do the REST call to link the thing to the user and store the relation at the platform. Note that in order to link the thing the user must be logged in and the thing must be activated (i.e. have a thing token)