It actually doesn't get anything but public info, which you can see in the permissions request page on Facebook. All it does is grab your name, profile photo and url. It doesn't even store anything in a database--it's all in-memory at the moment.