Then make it an independent email+password thing, so in case of a leak, something as critical and personal as a phone number doesn't get involved in the stolen

Then make it an independent email+password thing, so in case of a leak, something as critical and personal as a phone number doesn't get involved in the stolen data. (I know the irony of this in particular being Authy, but nevertheless phone numbers should NOT be risked to be exposed anyhow)