When it's free, you are the product. And in this case, so are your visitors. Cloudflare doesn't give free SSL, CDN, and DNS out of the goodness of their heart.
Be aware that despite their claims of privacy, their founder was all too willing to sell data from ProjectHoneyPot, the service which he started prior Cloudflare. I don't know for a fact, but I'd venture to say they are selling blocking and traffic pattern information there as well. After all, it's a giant honeypot.
From their terms:
"Cloudflare may aggregate data we acquire about our Customers and their End Users, including the Log "Data described above. " and "Non-personally identifiable, aggregated data may be shared with third parties." - This means they won't share identifying info. There is nothing in their terms which prevents them from sharing your traffic sources, bounce rates, time spent on site, number of visitors, what pages visitors view, etc.
Also, they have a 5 year agree with Asian registry APNIC to share DNS query information.
Basically, they are certainly able to sell information about your business or hobby web site. They aren't end user spyware, but essentially they are server spyware in my opinion.
I have avoided and will continue to avoid the Cloudflare bandwagon.