All the personal information you mentioned should be hashed or encrypted. For any given phone number, see how little information they have: just an account creation timestamp and a last access timestamp.