A more secure discovery alternative, that would prevent phone numbers from being revealed, would be to give the user the option to include first and last name, and optionally email address along with phone number in a hash sending that hash to the server. This way, unless you have the user's full name and (optionally) email address, along with phone number, you can't deduce the communication between both parties. This would also permit for pseudo names to be used. Now, with that comes some potential for spelling mistakes and other things getting in the way. To address this, and add a further layer of abstraction through hashing, I propose having a look at this Stanford paper on document fingerprinting, which employs a sliding winnowing algorithm to generate sets of hashes based on fuzzy matching. This works on small data sets too, such as names and email addresses, or even authentication words, allowing you to further account for spelling, but also further abstract names and identifying information from a final hash.

http://theory.stanford.edu/~aiken/publications/papers/sigmod03.pdf