iHasApp has a large list of URL schemes, mapped to the iOS App that they identify. The framework essentially runs through all of these schemes, and determines which URL schemes are handled by the current device, and create a list of application ids as a result of successful queries. Read more here.
The original schemeApps.json list was compiled by extracting the URL schemes and app ids from a large collection of app IPA files. Read more here. For a good example of a script that can run through your computer's iTunes' Mobile Applications, take a look at Heiko Behrens' iHasApp-related repository here.
Unfortunately, not every iOS app implements a URL scheme (less than 50% - link). As a result, not every app can be detected. Furthermore, iHasApp must know about an app's URL scheme to even attempt to detect it, and because this link is only made by analyzing an app IPA file, there is the additional bottleneck of needing to purchase and download an app from the App Store.
No. iHasApp only uses public and documented methods. Furthermore, iHasApp has already been used in numerous production apps that have passes the App Store review multiple times. However, as with any set of user information, it is probably best to disclose your use of such information to the end user.