I'm using cloudflare tunnel to access my movie collection on selfhosted jellyfin. Jellyfin accounts are behind a strong password.

Considering it's on the web, how bad is it? I'm not thinking about attacks, can I be flagged for piracy or things? Where does the ISP stand?