> Reading what cloudflare sells, people who have a domains on Cloudflare and buy Pro, Business and Enterprise plan have access to DNS analytics that displays DNS queries from Cloudflares DNS servers, including geographic information.

Those analytics are for authoritative queries against the domain(s) that you have on Cloudflare; not for queries to any domain.

Not logging _recursive_ queries against their public resolvers - and it's those recursive queries from end-users that hold the biggest risk to user privacy - is an entirely different thing, and these two systems can co-exist.

The distinction between authoritative and recursive queries is not meaningful in the context of DoH since that protocol is only about recursive servers. A user who connect to cloudflare through DoH is connecting through a recursive server, and knowing that the privacy policy say no logs, is unlikely to expect that logs are kept if the domain owner happens to be a customer of cloudflare.

Cloudflare could do as google and not include any query that comes via the public resolver. Any DoH query would thus be a blackhole in regard to analytics and only display data from users who used someone else recursive resolver for the query. In that way no logs from the public DNS resolver ever ends up as data, the privacy document is followed, and companies can not buy query data by becoming customers to Cloudflare.