Right, I can deny contact uploading all day long, as long as a bunch of people that have my number upload theirs to foostter it quickly paints a social graph wh

Right, I can deny contact uploading all day long, as long as a bunch of people that have my number upload theirs to foostter it quickly paints a social graph where I'm† precisely pinpointed even though I did not interact with foostter. † Or a hash but that's barely pseudonymous. The social graph alone could constitute PII as it could easily identify me unequivocally, but here's no way for me nor anyone outside foostter to know what happens internally, let alone request erasure.