I remember reading (but can't find the source, I think it was Anand) that they store a hash of the fingerprint data and a unique identifier of the phone.