The permission to use some data is the minimum permission requested (Email address). The intent here is to use OAuth to allow easy logins, not harvest data. BTW, The entire site is open-source at http://www.github.com/udit99/visamapper, so not only can you a) Verify that there is no foul play, but b) send pull requests with alternative login methods.