When you 'friend' someone, are you sharing your decryption key with that person? That seems very vulnerable to mass data collection when you start emailing it around to friends. Does each friend get a different key that you can disable if you believe they've been mismanaging your key?
If a person wants to see your data, that person asks you for it, and you use their public key to encrypt your data, send it over, and then they can use their private key to decrypt said data.
I doubt they are actually doing it this way as I imagine the overhead would be very high, but it need not be as cumbersome as sharing a specific secret key for each person.
It wouldn't be very high, they could easily put the burden on the client to do the encryption and like all practical public key encryption they only thing you encrypt with the public key(s) is a symmetric encryption key that the content is encrypted with.