It's mostly a question whether they store it or not -- although they have to store it in order to support notifying you when new users who are in your address b

It's mostly a question whether they store it or not -- although they have to store it in order to support notifying you when new users who are in your address book join the service. If their servers are compromised, a cracker could still get MOST of the info. Since the hashing function (and salting mechanism) lives on the phone, she could generate a rainbow table of all possible phone numbers and a set of emails for common domains.