That article is out of date. It says things like "Signal still knows nothing about you", but Signal collects every user's name, phone number, photo, and a list of their contacts and permanently stores that data in the cloud.

That data is only protected by a pin (which can be brute forced) and SGX which has a history of being leaky. Researchers even demonstrated that data could be collected from Signal at one point. There are very likely side channel attacks that would allow Signal, or the government to collect the data stored in the cloud.

https://web.archive.org/web/20250117232443/https://www.vice....

https://web.archive.org/web/20230519115856/https://community...