@kuketzblog we only upload contacts if the user explicitly requests it, and even then, only the 3PIDs (emails & msisdns) are uploaded, and are compared by hash not plaintext: https://github.com/matrix-org/matrix-doc/blob/hs/hash-identity/proposals/2134-identity-hash-lookup.md and https://github.com/matrix-org/sydent/pull/184 have the details.