Last year Uber was using Backbone and the JSON returned to the client included ALL information about the drivers you have used for trips including home address, phone number, etc. I wonder if this has something to do with that?
You could also use an auth token from the Android app and snoop around other users if you knew some info about them, which you could if you had access to a driver's phone (I did/do).
