If you are accessing the website from the clearnet link, the frontend will generate an Elliptic Curve Cryptography (ECC) key pair, and will never send the private key anywhere. The backend server already has a permanent ECC key pair generated, and its public key is stored in the frontend. With the ECIES scheme, you can encrypt data using the public key and you can only decrypt it using the private key. When the client needs to send any kind of D.A.D to the backend, it appends the frontend generated public key to the said D.A.D, and then encrypts it using the backend's public key. Now, Cloudflare can read the ECC encrypted data, but they cannot read the plaintext data. When the encrypted D.A.D reaches the backend, it will be decrypted using the permanent private key. The backend then processes the request, and the response must also be encrypted since it contains potential D.A.D, so it encrypts the response using the client's public key that it received within the request. When the response gets to the client (frontend), it is decrypted using the private key generated locally. This is how full end-to-end encryption and privacy between the user and the backend server was achieved, even with Cloudflare decrypting TLS data.