Truncating at the @ still leaves personal information (email address) largely visible to the Big Bad Internet (given that most people are @gmail.com or a few other big providers). You’d probably be better off setting them to the same value as username.