Tunnels stop you from opening a port so nothing is exposed openly to the internet^1^ but it does not keep your ip private^2^.
This is also incorrect.
The entire purpose of CF tunnels is to expose sites on the internet
CF tunnels (and services like it e.g. ngrok) rely on shared proxy servers that forward traffic based on HTTP host headers (which is why you can't forward arbitrary TCP traffic). The IP of the site will therefore have the shared IP of the company's proxy server instead of your own.