They are literally a MITM service.
If they start selling data they gather as a result of their product they will burn user trust and goodwill in a single day and seriously harm their business and brand. So they would never do it intentionally.
I once lost access to my Cloudflare account, and the only way to get support... wait for it.... required you to log into your account.
Same happened to me with PayPal. My 2FA was through Google Voice, and they blocked Google Voice so I couldn't authenticate. Now I refuse to use them. Recently I emailed a band to get an alternate payment option to buy a t-shirt just to not do business with through them.
cc jgrahamc
No, instead it's known for leaking private customer data (think authentication tokens and the like) onto the public internet [1]. Imagine if Gmail ever had a bug like that.