Then don't be a storage service and just run the API for them to shovel data from point A to point B. I'm speaking for others, but I'll still say that sometime

Then don't be a storage service and just run the API for them to shovel data from point A to point B. I'm speaking for others, but I'll still say that sometimes we don't want some of the data we post accessible to others. That seems an obvious statement, but I always use Twitter in a way that I find acceptable for sharing data with everyone. Facebook and Google+ are used in that way, but also ways where I selectively share things with people I trust to view the data I post. (To be clear, I don't use Facebook at all.) That's where things get complicated, because the service must enforce rules to keep these people from seeing those people's data. Those rules turn into 'features' and then you have a problem. A social sharing API doesn't need a ton of features, especially when it's designed to forward the data around to the people that need to see the data. By not storing it, you make things simpler and more resilient to attack.