I'm all for assuming the people who work there are good eggs with the best intentions, but Cloudflare, Inc. is a U.S. company. As I understand the U.S. legal landscape with regards to data and privacy protection, they could be forced to lie at a moment's notice and not talk about it.
So far as I know there is no legal way for the US to make a company lie about its activities. That is the basis of warrant canaries, which have not been tested in court yet. You can find cloudflares https://www.cloudflare.com/transparency/.
They could be forced to not talk about something via a gag order.
