Surprisingly Telegram awfully good on that list
Edit: I forgot to add that I found something little of about that report where Signal hash to phone numbers are absent " Which clearly signal store it"! And on Threema FBI still includ it even though it’s optional and 99℅ of the user will not put their number.
If your backups are accessible to others then you have no privacy no matter what tools you use, it is the ultimate back door. Same as running “scanners” client side.