Privacy and content rights on Facebook are and have for quite a while been very complicated. One of the worst aspects of this is with 3rd party applications, because they can have their own privacy and use policies that may be very different from Facebook's, even though Facebook does enact some limits on them.
Bottom line: Even though you may attempt to limit the use of content you post to Facebook, you should assume a wider audience may ultimately see, or even copy it.
Remember the girl who lost her job after she posted a photo of herself being disrespectful at Arlington National Cemetery? Dumb as her action may have been, you can bet she never expected her photo to turn up in newspapers all over the country.
For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.
"Sub-licensable, royalty-free." In other words, Facebook can not only use your photos to, in the terms other photo sharing sites use "administer the service," but they can grant other people rights to use your photos. Your privacy settings still apply, but using 3rd party applications can lead to you extending those permissions without realizing it.
The really crappy thing about this new service is that while you can choose whether or not your friends see your photos, once you do that, you are apparently enabling them to decide to give an outside company access to whatever that friend can see.
This is exactly why most banks deliberately do not include links to their log-in page in email communications. Instead, they tell you to go to the address provided in your account statement on your own.
All part of why I only post pictures on Facebook of limited resolution, and never anything I'm worried about being copied.