When we connect you with people you know from your Contacts, we don’t send raw phone numbers or email addresses to our servers. Instead, we locally hash the contact details first (with shared salt), which the server then uses to compare against other hashed values. Therefore, [+15552786005] becomes [a22d75c92a630725f4] and the original number never leaves your phone. This is a one-way transformation. In other words, we actually don’t know their information, unlike various other services.
Important note: Although we salt the data, it is possible to match a phone number to a hash, especially if the salt is known to an attacker. We’re looking at ways to make this even more secure (e.g., by joining client-specific data pre-hash or Diffie-Hellman key exchange). If you have a suggestion, please let us know at security@secret.ly as this is an active area of research for us.