I want to keep a list of my contacts on my phone so I can call them, but I never want the list of contacts to leave the device, through contact sync or similar. I’m using the Android built-in Contacts app.

On my old phone I used an F-droid app called ‘local contacts’ or ‘offline contacts’, but I can’t find it with my new phone. It would create a new account, separate from your gmail account, to associate the contacts with. Something like that might be nice to have, although I don’t know how effective it is.

I see in my settings under “Google Contacts sync” that “Sync is off” and “Also sync device contacts” is off. “Device contacts” sounds like maybe some Android built-in version of the offline contacts app I mentioned before. Does anyone know if this is the case?

I’m worrying that if I use a builtin features, Google will ask me about backup for photos or something at a later point, I’ll reflexively click ‘proceed’ without realizing what I’m doing, and this will activate all Google-related sync features, including contact sync, updating my Xkeyscore (NSA) profile with my social graph before I know what’s happening.

Perhaps it’s best to assume my social graph is already known by Google? Then maybe I should focus on limiting others from getting access to it? I believe apps have to ask before accessing any contacts so I guess I could just deny access for apps I don’t trust.

There are few questions above, but I’m really mostly looking for a discussion about what good security practices are when it comes to phone contacts. It seems like one of the more sensitive sets of information on a phone.