Does Android upload my address book to Internet if I never explicitly enabled this? Suppose the following scenario:


User gets an Android device;
User created Google account, not enabling any "sync"s or "backup"s;
User inserts a SIM card with contacts;
User copies then to the "Phone contacts", not to Google account;
Users installs various programs that does not request permission to view contacts, root or contain exploits.


Are the phone numbers still secret from the Internet in general and Google in particular?

Has somebody experimented (monitored all traffic of Android device, including encrypted) and confirmed or disproved this for particular devices, Android versions and usage scenarios?

How do I proof the device from vendor-installed backdoors that can "mistakingly" send my data on opportunity; for example, if user never rooted the phone, not over Wi-Fi (which user can monitor), and when there is legitimate mobile traffic?
You can never guarantee that it's cent per cent private. 
First let's begin with Android apps. In order to earn money you have advert's in the apps.In order to get localised adds it has in built code which will access your location and display the advertisement based on the locality you are presently. In doing so your identity is revealed there itself.

Your device name, id, carrier etc. is stored in the third party servers. To which no one can guarantee whether the communication is secure between their server and what is done with the information stored in the server.

You cannot disable this featured as it is hard coded in the application and the best way to this is simply un-install.

You can verify whether the app is collecting information or not through some Apps from the play store like Permission checker.

In the app you can sort out apps that might cost you money, send data, etc. Check for the application permissions which are listed and check it's use on the Web.

If you see any application that has permission violating your privacy like viewing contacts, device id, network information you need to delete those apps from the device. You cannot modify the code even if possible as it violates the policy.

Also make sure the permissions are relevant to the functionality of the application. If it is irrelevant(flash light app Is having permission for viewing contacts ,location which is not at all relevant then you need to remove it. ) then you need to remove this app and find another app from the play store.