https://spyware.neocities.org/cloudflare.txt

Tl;dr: The text states that CloudFlare acts as a bad Man-In-The-Middle for the entire internet:

1. It tells you which browser to use, or else you'll face a captcha or a "Access Denied" screen.
2. The extensive data collected by JavaScript scripts injected on-the-fly by CloudFlare poses a privacy threat to users (mouse movements, scrolling, keystrokes, device information, mouse clicks, and more).
3. It acts as a Man-In-The-Middle for SSL. When you connect to a website, you're actually connecting to CloudFlare's servers, which then relay the data to the actual website, allowing them to intercept all traffic between you and the website.
4. CloudFlare often blocks Tor users without reason. Using Tor doesn't make you a criminal, right?
5. CloudFlare makes browsing the internet without JavaScript nearly impossible.
6. Cloudflare can potentially attack individual users with malicious JavaScript because you typically enable JavaScript to use websites, falling into their trap. Since they track users, provide personalized code, and collaborate directly with the US government/DHS, there's no reason they couldn't tailor attacks to specific users.

This isn't just an individual problem but a fundamental threat to the internet ecosystem.

Many of us admins specifically added cloudflare because of users trying to use our instances for nefarious purposes. For myself, it was the last option before shutting down my instance altogether. From Tor users trying to use it without any regard for my hosting to the CSAM attacks, cloudflare gave me an option to keep it running for the time being. I don't agree with everything they do, but it's the only way right now I can keep the server on without a constant despamming.

There is no way to "disable" cloudflare if an instance has chosen to use it. It will sit between you and the server for all traffic. You can choose to use another instance if you like, but server owners can choose what to do with their own servers.

cloudflare has an option to serve your content inside tor without an exit node, is that better or worse?

I'm using it to allow my ipv6 only server be visible for ipv4 users, maybe I'll think on alternatives now

That would be misconfiguration on the remote instance's end. Are you sure it works if you're not on Tor in the first place?

That's definitely server to server traffic, it basically goes client->home instance->remote instance and AFAIK it's not a passthrough request, it makes it own request.