Yes, anything that sends information in the URL is obviously visible to anyone who cares to look at it, and would breach most privacy legislation.
This is a good idea in principle but the execution isn't really viable in its current form. They need to re-think how they get the e-mail addresses and how they keep track of users.
In addition they offer no privacy policy. That means they have complete freedom to aggregate all of the information you send to them, via your app, and sell it.
This is a good idea in principle but the execution isn't really viable in its current form. They need to re-think how they get the e-mail addresses and how they keep track of users.