I would argue that this belongs to each individual app. By logging in to the app, users implicitly agreed to allow apps to view their information. It is up to the app to not show this information to everyone. In fact, accounts-rails already does this by limiting the number of results to 10 and not showing (or even recording) email addresses.

In the case of backbone apps, they act just like users, so a backbone app cannot even query this API in accounts. It can query it in Exercises, but then it's subject to these restrictions. I think this is good enough?

If not, you can always open an issue :)