Majority of users use Gmail for it's reputation as an email service provider, and if one adopts standard safety procedures then they should be fine with it. Google does not divulge or sell private information, but they collect and store data on individuals and use it in marketing strategies.
Email and phone messages are both possible, email is more secure and except you have lots of funds linked to the account you are protecting, it would be fine for protecting your account. Authy is my preferred means of authenticating an account.