Facebook nowadays asks you to confirm the permissions you're granting to another site, and if you give timeline-post permissions, then it asks what privacy level the posts should be. I always mark "Private: nobody but me can see those posts." Problem solved.