appreciated this rec. trying it out, so far looks legit. always worried that these things are free (so what data of mine are they selling) but the permissions seem locked down

Truecaller is not bad in some areas like EU, US etc as there are strong privacy laws. They have slightly different versions based on the country and jurisdiction.

But where there are no strong privacy laws like india, truecaller is straight up spyware

https://restofworld.org/2022/how-truecaller-built-a-billion-...

At the very least, it always tells Truecaller who is calling you (your phone doesn't have a copy of the database - it is being looked up).

And at least as of a few years ago, Truecaller would upload a copy of your phonebook to their servers. That's how they bootstrapped their database - from user's addressbooks. I only ever used it on a burner with an empty phone book, and occasionally get Truecaller pearls like "Annoying John - do not answer" as the caller's name.