Two spam call blockers upload users’ contact lists into databases: Consumer Council

Two spam call blocker apps – “CallApp” and “Truecaller” – upload and consolidate information of the entirety of the users’ contacts into the apps’ databases, rendering it available for search by other users, the Consumer Council has found. 

For CallApp, the council found that it automatically uploads and integrates all contact information into the traders’ databases for other users to perform a “reverse lookup”. 

By simply entering a mobile number, other users can trace the name of the number holder and read their personal information, including names in Chinese and English, email addresses or social media links, etc. 

Truecaller also accesses and uploads users’ contact lists in a similar manner, but only when the user downloads an APK file from its official website, installs the app, and enables the “Enhanced Search Functionality”. 

A test by the council also found that the personal telephone numbers of numerous staff members as well as their friends and relatives can also be found in the database of the two apps. 

The names and other information of these number holders are also made available for viewing without any need for approval from the relevant people. 

In some cases, sensitive information such as former residential addresses including floor and flat number and the amounts of rent were found listed alongside the names of the number holders, raising suspicions that the data is being obtained from the contact lists of the number holders’ landlords or real estate agents. 

The privacy policy of CallApp stipulates that users’ personal data and unlisted data will still be stored in the developer’s backup system despite the five years  retention period. 

The council said this implies the data might not be completely deleted and it is advisable for consumers to think twice before choosing to use this app.