If a website loads the javascript facebook API on their site, and you're logged into facebook in general, they know who you are and what page you were on when t

If a website loads the javascript facebook API on their site, and you're logged into facebook in general, they know who you are and what page you were on when the script was loaded whether you give the site permission or not. When the http request is made to facebook, they get their domain cookie back which has your user info in it. On top of that, when their javascript runs they get full access to all the data of the window that made the request meaning they get the other site's cookie as well absolutely everything else. If you don't want to be tracked by facebook online, you only have a few options. Disable cookies, disable javascript, or only login to facebook in an incognito window. Otherwise, they can track exactly who you are and where you go on any site that makes any request to facebook. Even still, if any request is made to facebook, they can still anonymously track you even if you aren't logged in. As for apps, I don't think the facebook api would be able to find out the specific usage of the app unless the app purposefully gave it up, although they would know when you login.