You can selfhosted tailscale so that they don’t have any access. You can’t with cloudflare tunnels as far as I know. Tailscale’s client is open source, so is their Headscale server which originally was developed by a 3rd party. You can look into the code for that. Not sure what you’d want me to say. If you really want to be informed I’d inspect the code yourself
Tailscale shouldn’t be getting your data anyway. It’s a mesh VPN that directly connects devices after their auth server gives out certs and let’s clients know where to find another. If you’re not comfortable with using their server for this I’d suggest you look into the open source headscale server. I do remember it routing through their server in the rare case NAT punching doesn’t work
I run wiki.js for documentation for my home lab, but also things like the custom rom setup for my phone. However it’s hard to keep it up to date as I forget it exists. I mostly use it to document setting up windows server core with different roles as I don’t need to do that often, but most tutorials on the web are SEO optimised with low quality
This video from thiojoe is probably relevant here. It is mostly for scam websites, but maybe it’s useful for this too? At least gives you some platforms to contact
Does it necessarily need exploits? I might be wrong, but I believe games running in wine can access any file your user can. It should still be able to delete, edit or encrypt them. Wine just translates calls, it doesn’t create a locked down container or anything iirc