Well put it this way, making it assertive sentence:
You are who you say you are on Facebook.
To make it simple I'm adding "one": You are the one who you say you are on Facebook.
It sounds like the speaker is talking to himself. It will mean like you suggested if we omit "you" after "who" in the original sentence.
"Who you say you are on Facebook" is a noun clause acting as complement. Reversing the question form, the sentence becomes "You are who you are...."
"You say you are (your name, profession, qualifications, body shape, etc.) Is this true?" is the upshot of the question. The grammar of the original is fine.
Let's say I have a Facebook account under the name Marilyn Monroe. I claim to be Marilyn Monroe. I say I am Marilyn Monroe. You are naturally sceptical, and say to me: 'You say you are Marilyn Monroe, but are you really Marilyn Monroe?'
I say I am Marilyn Monroe on Facebook. Marilyn Monroe is who I say I am on Facebook. (That gives us two pronouns.) With this version, you are still sceptical and ask about this identity - who I say I am on Facebook - by saying, 'Are you who you say you are on Facebook?' (There's the three pronouns all in a row.)