He may not be intentionally “uploading” contact info, but the HTTP server could be configured to keep log of all the contacts email addresses.

Which HTTP server? the getFavicon method requests the favicon from each domain, so any one email provider only gets a single request for a favicon. It doesn't send all the contact info to any single server.

So reading the code, say you have in your contact

[email protected] [email protected] [email protected]

The code makes a single request to acme.com (to get the favicon) and one to support.google.com to get that favicon (there's a special case for google to avoid getting the new doodle of the day). That's it.

I don't really see how that's sharing contact details.

Yeah I read the runthrough here : https://news.ycombinator.com/item?id=31432334

It's a bit harsh, but I would have thought that the domain filtering would be done on device and favicon retrieval also on device. I must check the source code tbh.

An interesting case though.

It appears domain filtering and favicon retrieval are indeed done on the device, looking at the code. It also appears to be off by default, requiring a user to turn it on manually. It looks like this also excludes any mail in the junk folder (to preserve privacy even when someone turns this on, presumably)

I can't see how to do it in any more private way than this - it seems akin to a claim of "browser leaks details of requests to a third party", where said third party is the user's DNS server.