I have experience working in large data centers that provide hosting. What I can tell you is that various government agencies do and will randomly come by the data center with warrants and court orders for things. I've literally had NASA show up (wtf?) and have to pull a server offline while they mirror the hard disk. All very hush hush make excuses to the customer when they open a ticket. Another thing that happens is that the FBI has placed their servers within internal spaces of the network. When they get a court order they can open a ticket with our abuse department and whatever switch port the feds are interested in can be mirrored and sent to their packet capture servers.

According to W3Techs, Cloudflare is used for 80.9% of all known reverse proxy endpoints which account for 19.8% of the entire Internet. It’s safe to say it’s used to host both legal and illegal content with that broad of a scope.

They are an American company and must cooperate with law enforcement when abuse is reported. If you’re planning on hosting pirated content, that most definitely violates their terms of service and will get you in trouble.

No they do not, and yes they are an American company they have to follow the rules. They also MITM, I wonder how many of the self hosters who use their tunnels realize this. Hosting a password manager behind them would be funny since they can scrape all your passwords.

on its own cloudflare provides anonymity the same way vpns do

Cloudflare takes a neutral response in general but are not resistant to law enforcement demands.

What you can do is to create a cloudflare account on Tor, buy a privacy-focused VPN that supports port forwarding, connect your server to the VPN and point the DNS record to the VPN ip address. And then create a port rewrite rule in cloudflare settings (because port forwarding supported VPNs rarely support lower than 1024 ports). Atleast in this case, law enforcement notices won't be forwarded to your ISP.. still not bulletproof, but good enough for most stuff if you have concerns.

If you're doing anything risky, then you can't rely on a service like cloudflare.

They are 100% in bed with all of the 3 letter agencies.

If, for whatever reason, someone with power deems your website unpleasant, it will be taken down unceremoniously and any information that links it to you will be used to find and punish you.

Edit: I found their Transparency Report: https://www.cloudflare.com/transparency/

Though, I don't know whether those numbers are high or low, considering the large amount of customers they have and the crazy amount of internet traffic they do.