1. Freecycle.org uses PAIR NETWORKS a company in Pittsburgh, for their mail services.
See for yourself. http://www.robtex.com/dns/freecycle.org.html

2. Yahoo's Terms and Conditions are exceedingly clear on the nature of information sharing. Never agree to something you don't read.

3. As a former operator of a Yahoo! store, a job I did for a LONG time, I can tell you from direct first hand experience about Yahoo Wallet vs. Non-Wallet transactions. When the customer does NOT use Yahoo Wallet, Yahoo passed the credit card data to the Yahoo Store operator. Yahoo stores are akin to a shopping mall, in that Yahoo provides the hosting and storefron software but - and this is a critical but - they DO NOT process the credit cards. It's up to the merchant to work out credit card processing. In most cases, the merchant will engage in the services of an authorized online transaction processing service and merchant bank, but some merchants simply choose to collect credit card numbers without processing them and use their existing terminal to manually type in the numbers. That's exactly what I did when I was selling Magfire fire starters. I'd see that I had a sale, I'd log into the Yahoo Store system, PRINT OUT the order form - which included the credit card number of the buyer, manually type in the CC number, bill the customer and ship the item. I'd sit on the printed order forms for two weeks, and then shred them. Not all merchants are as careful with credit card data.
If you used a Yahoo Store and the merchant using Yahoo Store services didn't secure your CC data, that's not Yahoo!'s fault, it's the fault of the merchant. If you actually had a real police investigation and the police had a reason to think that Yahoo was in any way involved or could provide material information to support a criminal prosecution, Yahoo! would have no choice at all, and would comply.