@luis_in_brief for privacy violations from server access to your data (they sold your data to Cambridge Analytics), that is almost entirely on the admin, with some small amount of blame on the protocol (we don't have great support for using a platform with an untrusted admin).