For what it's worth, I have my doubts that this applies to a generic call/sms on any old Android device. I would think it's more likely to apply to services such as the Hangouts calling or Google Voice, and probably Google Fi, all of which make sense to collect that data, but the privacy policy doesn't absolve itself of that.

> When this Privacy Policy applies

> Our Privacy Policy applies to all of the services offered by Google Inc. and its affiliates, including YouTube, services Google provides on Android devices, and services offered on other sites (such as our advertising services), but excludes services that have separate privacy policies that do not incorporate this Privacy Policy.

For what it's worth, I have my doubts that this applies to a generic call/sms on any old Android device.

Does it matter? This is completely in line with their privacy strategy the last few years. Slowly add new terms to the privacy policy, so that people find it acceptable. When asked, point to some unharmful or obvious application. At any rate, it makes it possible to do what the article stated. And since a lot of stuff happens in Google Play Services these days, it becomes kind of hard to find out how the privacy statement is operationalized.

Isn't Messenger AOSP?

It's not. Google stopped open sourcing a lot of their apps with Android L. IIRC the material Calendar app also isn't open source.

Source: I was working on https://github.com/moezbhatti/qksms when Messenger was released.