Understand the new trust boundary

A VPN does not remove trust from your network path. It moves it somewhere else.

Let’s start with what it really does. A VPN protects your traffic from the local Wi-Fi operator and from anyone else sitting between you and the VPN endpoint. The coffee shop router sees encrypted packets flowing to one address, and nothing more. Against that observer, the protection is real.

Now look at the other end. Every packet you tunnel gets decrypted at the VPN endpoint and forwarded from there. The VPN operator handles that forwarded traffic and can see the metadata: which destinations you contact, when, and how much data moves. If a connection uses plain HTTP, the operator can read the content too.

Here is who sees what:

observer between you and the endpoint:
  sees:  your IP ⇄ endpoint IP, packet sizes, timing
  can't: read content or learn destinations

the VPN operator, at the endpoint:
  sees:  your IP, every destination you contact, timing, volume
  can't: read content protected by HTTPS

This is why I am skeptical of “no logs” marketing claims. You cannot verify them from the outside. You are choosing to believe the operator, and that is fine as long as you know you are doing it.

A VPN also does not make you anonymous. Websites can still identify you through accounts, cookies, browser fingerprints, and application data. Log in to your email through a VPN and your email provider knows exactly who you are, tunnel or not.

HTTPS still matters. It protects the connection beyond the VPN endpoint, all the way to the destination. The two protections layer: the VPN covers the first leg against local observers, HTTPS covers the content end to end. You can see this layering in the browser. The padlock icon is still there while the VPN is active, and it is doing a different job.

My advice is to ask one question before turning on any VPN: who am I moving trust away from, and who receives it instead?

“Away from an airport Wi-Fi operator, toward a server I run” is a clear trade. I make it every time I travel.

“Away from my ISP, toward a company I know nothing about” is also a trade. It might even be a good one. Just make sure you noticed you made it, and that you read what the new party promises before you hand them every packet you send.