Nothing about this requires world-readable data, privacy can be its own layer. FriendFeed[1] did this well back in the day: it aggregated your feeds and let you control who saw each one.
Fair point on app-level auth, still far less centralized than the status quo, where the data, the permissions, and every function on top all belong to one company.