Simply bury something in the TOS along the line of "oh well actually we reserve the right to do whatever with your 2F phone number" and be done with it.

Or just keep a hash of the number as GP described.