Experts are warning that a viral Facebook app may be looking at more than your profile's "most-used words."

The "What Are Your Most Used Words on Facebook?" quiz, which has been used and shared millions of times, offers to scan users' Facebook profiles to generate a colourful word cloud.

But privacy experts say most people are also giving the app's parent company, South Korea-based Vonvon, permission to access photos, friend lists, and a range of other personal information.

"The way Facebook has built its platform makes it relatively easy for online apps like Vonvon's to quickly access a wide range of personal information from users' social media accounts, and then share that data with pretty much anyone," CTV News technology analyst Carmi Levy told CTVNews.ca in an email.

When users try to use "Most Used Words," the app automatically prompts them to give permission for Vonvon to access data, including:

  • Their public profile (which can include information such as their age, name, gender, birthday or hometown)
  • Their Timeline posts (which can include photos, statuses, and links that they've shared)
  • Their friends list (which, Levy said, can expose friends to targeted advertisements, even if they aren't personally using the app)

For users who agree to this, Vonvon's privacy policy outlines a number of ways in which the company can use that information.

According to the privacy statement, users who register for Vonvon services allow the company to collect "personally identifying information," and to "store data for as long as it is necessary to provide products and services to you and others."

It goes on to say, "some information may remain in backup copies and logs for longer periods."

Further down in the statement, it says the company can continue to use "non-identifying information" even after a user has terminated their site membership.

"Most Used Words" users also give Vonvon permission to share information with advertisers and publishers so they can see how different ads performed. And, users give the company permission to store information on servers "at any location."

But while the fine print may sound intimidating, Levy says there's no evidence Vonvon is "stealing" data.

"If anything, it's asking for permission, and users are granting it without giving it much - or any - thought. The service's Terms of Use statement makes it explicitly clear what the company may do with the information once the user provides consent," he said.

On Tuesday, Vonvon CEO Jonghwa Kim responded to criticism on the tech website comparitech.com, saying that Vonvon only uses data to generate quiz results, and that it does not sell information to third-parties.

Kim also defended his company's use of information to "better understand" users.

"Are we the only company in this planet (to) use analytics tools to better understand our users?" he asked.

Levy also noted that Vonvon is not the only company requesting personal information online.

In fact, he said, many other apps also access a wide range of data through Facebook.

"The Vonvon word cloud quiz is just the latest example of highly invasive social media-based apps and services that can easily compromise huge amounts of personal data in seemingly no time at all," he said.

And, Levy said, not every company outlines its privacy policy as clearly as Vonvon has.

"In this particular case the company is being very clear about how it uses the information, which I think should be applauded," he said. "At the same time, not every company plays by the same rules."

But Levy didn't place the blame with the companies.

Instead, he said, it's up to users to think before they click, rather than rushing to install the latest app.

And for those who have already forfeited their information, it's never too late to go back through your Facebook history and delete any apps or "unlike" any posts from companies you don't trust, he said.

"If we're looking for a villain, there is none," Levy said. "Instead, we should look in the mirror, and then learn to take the time to read carefully before we click on the Agree or Install button."