Your card info stays safe
When you use your phone to pay in stores, Android Pay doesn’t send your actual credit or debit card number with your payment. Instead we use a virtual account number to represent your account info – so your card details stay safe and secure.
I believe Apple Pay works the same in this respect so the virtual account number is not cycled per transaction. I can't remember if it's cycled per vendor or just unique per device.
It honestly may be more productive to operate under the mindset of "My private information that is acquirable by a cursory examination of me (this includes face, which is obviously publicly visible) will inevitably find its way online in a way outside my control. What do I do given this reality?"
There is a fine line between "somebody who knows me (even if not personally) can recognize me on the street" and "everybody can know everything I do out in public or online"
Your card info stays safe When you use your phone to pay in stores, Android Pay doesn’t send your actual credit or debit card number with your payment. Instead we use a virtual account number to represent your account info – so your card details stay safe and secure.