It's worse than that now. If you sign up with Gmail it will request access to view your contacts in the OAuth dialog (and will periodically keep requesting this access if you deny it). So no uploading is even necessary; it's sufficient to be using a big email provider and then accept the nag notices.
