Are contacts stored in Contacts Provider under one application's account visible to all other applications?

Question

I have read about the Contacts Provider API, but it is not clear to me how applications interactions are regulated. If an application stores contacts in an account specific to that application, can any other application given permission to access contacts still read the information of those contacts (i.e., of the other application)? Or does each application have access only to its own accounts and any contacts manually entered via the (default) Contacts application?

Answer 1

Yes, all data stored in Contacts Provider is visible to all apps with READ_CONTACTS permission and if the user has given the permission. From the official documentation of Android Developers - Retrieve a list of contacts,

Request permission to read the provider

To do any type of search of the Contacts Provider, your app must have READ_CONTACTS permission. [...]

This is why contacts apps can generally show multiple account types for the same person (e.g. Google, WhatsApp, Microsoft), and also why social messaging apps (e.g. WhatsApp) and social media apps (e.g. Facebook, Twitter, Instagram) can detect registered accounts based on phone numbers and/or emails stored in the Contacts Provider.

Answer 2

Whenever you start using an app, it asks you for permissions to perform the tasks the app is supposed to do - like access to camera, to contacts, and so on. Those permissions are app specific. You can view the permissions when you go to your phone's configuration -> privacy -> manage permissions.

If you wish, you can revoke permissions of any app you think it shouldn't have that specific permission - it will not harm the app itself, and when the app needs that access again, it will ask you.