@debacle @mindaugas But the phone number is only used for verification purposes. And it does not have to be the same as on the device's SIM card; it can be a VoIP number or even a landline. And the number can be hidden from other users.

Regarding servers: Signal has created a global server network, using large providers like Amazon Web Services, Google Compute Engine, Microsoft Azure and others around the world. As s a small nonprofit organisation, this is a smart strategy to minimise risk.