I hate to add to the conspiracy, but I know my eye doctor uses a 3rd party which has sections of their hipaa privacy acceptance which allows them to use your info to sell you ads if you don’t decline. Phreesia, is the 3rd party company. Now add the other apps that track your location… time spent there…
and I know my grocery store does the same when you use the discounts. and worse, they have facial recognition so I can’t even opt out (kroger).
Your issue was likely a combo of that.
+1 for cloudflare. But I don’t use their tunnel products, I just expose my ports to only their known IPs. With cloudflare you have a nice “free” waf in front with tls that points to a secure(nginx proxy) or unsecured docker container. Audiobookshelf is a great example. Is best to use their dns product too, for easy management of your public facing sites.