zlacker

Check if GrapheneOS suits your needs. It has "contact scopes", ie you cna literally allow the app to see single contact only.

Same with storage scopes: one directory and that's it.