They do not need to sell metadata. They can sell services. Neither Google nor Facebook need to sell data. They sell services.

Those companies are not obligated to disclose what metadata they might have. Neither is NextDNS.

If the Privacy Policy stated that NextDNS will not create, collect or acquire metadata about its users, then we would have less reason to be concerned.

However the NextDNS Privacy Policy is all of nine sentences. It is not very restrictive.