Most of the service revolves around you authenticating greplin (using oauth or xauth) to provide them with a feed of your data.

Greplin's core service really is tied into reading all of your stuff. That is a privacy nightmare in some regards, but all of this data exists in other services already, so you trust someone else with it. Question is whether you trust Greplin i suppose!