Your CB Query Field isn't returning anything if the user has privacy set? How is your query structured? user_id can't be private so it's best to use it and only it in your queries to match users to database rows. Query fields also don't have an edit mode so you can't set privacy for them unless you've set privacy for the entire tab it self, which the above API that I've provided will ignore that.

I don't know what to tell you. I'm not the newsletter extensions developer nor do I know how it's processing fields. The API is designed to respect user privacy and admin configuration, there's no getting around that except for direct user object substitutions (e.g. [user_id], [username]) or database queries.

It depends on how the fields are processed. I can't give you a definitive answer, because it's a yes and no situation depending on how the fields are processed or how the substitution is supplied.