Your contacts are hashed locally on your device. Only the hashes are pushed to Vexl.

If you and I have Alice as a contact, we both produce the same hash of her number. That way we have visibility of each other's offers since we matched on Alice has a common (hashed phone number) contact.

You can read a little more in the blog after 'If someone were to successfully decode the hashed numbers' https://vexl.it/post/understanding-vexl-security-privacy-and-building-a-web-of-trust