It also requires access to share on your Facebook wall without notifying you, which it seems to do after each game you try out on the website. Removing specific permissions from an application on Facebook is a much harder task than it seems to be. Also, if it requests so much information from Facebook, why does it still require me to type in my birthday and upload a picture of myself?
If they don't have a button that says "share" that you click before it posts that's a TOS violation and will likely be changed quickly if the FB compliance team is paying attention.
Fact of the matter is that install rates often don't change much when you ask for additional permissions. Most users don't care. There's often no compelling reason to build out complicated permissions flows when the standard "ask for it all up front" works just fine.
Have a source for that information? Facebook's own API documentation page says: "There is a strong inverse correlation between the number of permissions your site requests and the number of users that will allow those permissions. The greater the number of permissions you ask for, the lower the number of users that will grant them; so we recommend that you only request the permissions you absolutely need for your site."
