I signed up for Beluga while on a ski trip with a bunch of friends. I used it for the weekend -- it worked pretty well -- and then forgot about it.
A few weeks later, I started getting notifications on my phone: "Firstname Lastname is now on Beluga". The only problem? I had no idea who Firstname Lastname was. But I had a suspicion. See, I had synced my iPhone contact list with my Google Account, so unfortunately my iPhone has just about anyone who has ever emailed me inside it's address book.
I checked the address book and, sure enough, the person Beluga was notifying me about was in there.
So here's the thing: iPhone notifications are push, not pull. Which means a Beluga server pushed this notification to me. Which means the Beluga server knew this person was in my address book. Which means the Beluga app uploaded my address book to their servers.
I know that in this day and age, practices like this are becoming commonplace, but I think downloading someone's address book without asking permission is wrong, even if it is contractually allowed by Apple's TOS and the API.