I have an app, and when they first login, I send a classic confirmation email. When users need to reinstall the app, sometimes users send messages to our support saying: "I don't remember the email used to register my account, how can I have the verification code?"

This is pretty annoying, so I thought about sending to users a message like 'we sent a verification code to a\*\*\*@gmail.com' but I'm getting worried about security issues and data protection policies. What do you think? Could this be a security problem? Do you know a better way?