Privacy policies are only as good as your ability to legally enforce them. And without a name or address, you’ll struggle to do that against a github account.

Cloudflare may know their identity, but thats still a gamble.