Three scopes: Account · Cloudflare Pages · Edit, Zone · DNS · Edit, and Zone · Cache Purge · Purge. You create a custom token with exactly these and nothing more.
Yes. It is stored encrypted, never exposed in the browser, and you can revoke it any time from your Cloudflare dashboard without affecting your live site.
To your own Cloudflare Pages project and domain. You pick the exact site during setup, so content lives on your infrastructure.
No. You can always choose Manual instead and copy the content to publish it yourself. Cloudflare is just the one-click option.