I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud":
MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing the data, and passes that to importContacts() [1], which performs an RPC call to "the cloud", passing the contact list upstream and obtaining a server-processed list as a reply.
For me this is a major trust breach, and makes all the fuzzy claims about the app's security absolutely worthless.
MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing the data, and passes that to importContacts() [1], which performs an RPC call to "the cloud", passing the contact list upstream and obtaining a server-processed list as a reply.
For me this is a major trust breach, and makes all the fuzzy claims about the app's security absolutely worthless.
[0] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...
[1] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...