GP says "Cloudflares of the world", i.e. companies providing similar services. We can take your word when it comes to Cloudflare itself, but that doesn't mean your competitors don't sell, barter or exchange data - and frankly, at this point, just possessing this data is grounds for reasonable suspicion. At least it seems to me that whatever value or code of behavior can be broken for profit will get broken by someone eventually.

(And even as we trust Cloudflare of 2019 doesn't do it, who's to say Cloudflare of 2021 will still live by this code? Can you guarantee that? I often find myself wishing for an established way for a company to make legally enforceable vows about its behavior. Maybe there is something like this already?)