Despite not giving it contacts access, Telegram has clearly found some way to interact with phone contacts from other services — presumably scraping metadata from iOS itself.

Because of this, Telegram is now uninstalled from my phone until I can figure out what they changed. Be wary that you may experience the same issue.

I’ve been using a burner number with Telegram for awhile now _precisely_ to prevent family from finding my contact there. Please be wary if you use this setup.

In the meantime, I've hit block on the one number that popped up as having just joined Telegram. At least the block tools are fairly robust.

This continues a running theme of corporate platforms stapling my accounts together through their ads and data collection integrations instead of account setup. Google+ did the same thing to me by advertising my personal profile as "people you might know" to my family.

It would be really cool if the invasive push to advertise everywhere didn't also out people's private lives to family that may take hostile action against us, thanks.

I think what I’m going to do for now is keep Telegram desktop available, since contact metadata is not available there. I’m going to also set Telegram back up on a burner Android device.

If contacts from personal numbers keep coming in, I’m going to possibly recreate my account.

Are there good instructions on what to look for/how to restrict or remove Telegram metadata from an account? It seems my number is still associated to the one I set up properly, though it's possible they scraped my device number or Google Voice number from metadata.

Since this is getting boosted, I have no idea what's going on, and this could be Telegram being Telegram, here are the symptoms for my setup:

1. I have Telegram set up using a Google Voice number not associated with any other account and with blank contacts. That number is still the number associated with Telegram.

2. I had Telegram installed on an iOS device with co-residency to a personal number (defined by my CDMA info) and two Google Voice accounts (defined in Google Voice.app). The first account is the Telegram number, the second account is an unassociated personal Google Voice number that I use.

3. I disallowed contacts access for Telegram to my phone's contact list from the first time I installed it. iOS has a permissions model that lets you deny specific permissions on a per-app basis, and I've continued that with every subsequent contacts challenge the app has sent me. I'm reasonably sure I never clicked "allow" on any subsequent challenge.

4. About a week ago, I received a contact on Telegram from someone that has the second (personal) Google Voice account number. I assumed they probably searched for me specifically by my account name and ignored it, since they have that info.

5. Today, I receive another invitation, "X has joined Telegram", this time from an area code and number I recognize that should not have this info. This caused me to delete the app from my phone after blocking the contact.

My current hypothesis is that while main device contacts are denied, Google Voice's application furnishes this info or leaves metadata sitting on the device that Telegram slurps up. It's possible that something simpler is happening here, though, like fat-fingering a dialog a week or more ago. But I'm pretty sure that didn't happen?

Either way, it's enough to provide a cautionary account and to kill the app and its session from my main phone until I figure out what it's doing. I'm certain this is one of those almost-good-faith integrations with customer phone numbers, but I haven't figured out which one it is yet.