A sidenote that might be irrelevant, but fully private data never got shared. Only the friend data that is visible to the person who gave the API permissions.

A sidenote that might be irrelevant, but fully private data never got shared. Only the friend data that is visible to the person who gave the API permissions. Here is a simple example: you posted 3 photos on your FB profile. One was fully public, another one was friends-only, and the last one was only available to you and your relatives (which i am not one of). If i used such a cambridge analytica app and gave permission to my friend info, it would be able to get the first two photos, but not the last one (because I have no access to it myself).