This is not a background process but a way for a user to actively share data between web apps - it's a "push" action the user must instigate, not a "pull" from

This is not a background process but a way for a user to actively share data between web apps - it's a "push" action the user must instigate, not a "pull" from the third-party wanting access to the data. There is no more "inadvertent data disclosure" than when someone knowingly tweets a link to a file in their public dropbox, or uploads an image to Facebook.