Understand the new trust boundary

A VPN does not remove trust from your network path. It moves it somewhere else.

Start with what it genuinely does. A VPN can protect traffic from the local Wi-Fi operator and other observers between you and the VPN endpoint. The coffee shop router sees encrypted packets flowing to one address, and nothing else. Against that specific observer, the protection is real.

Now look at the other end. Every packet you tunnel gets decrypted at the VPN endpoint and forwarded from there. The VPN operator handles the forwarded traffic and can see metadata: which destinations you contact, when, and how much data moves. If a connection uses plain HTTP, the operator can read the content too.

observer between you and the endpoint:
  sees:  your IP ⇄ endpoint IP, packet sizes, timing
  can't: read content or learn destinations

the VPN operator, at the endpoint:
  sees:  your IP, every destination you contact, timing, volume
  can't: read content protected by HTTPS

This is why “no logs” marketing claims deserve skepticism. You cannot verify them from the outside. You are choosing to believe the operator.

A VPN also does not make you anonymous. Destinations can still identify you through accounts, cookies, browser fingerprints, and application data. Log in to your email through a VPN and your email provider knows exactly who you are, tunnel or not.

HTTPS still matters. It protects the application connection beyond the VPN endpoint, all the way to the destination. The two protections layer: the VPN covers the first leg against local observers, HTTPS covers the content end to end.

My advice is to ask one question first: who are you moving trust away from, and who receives it instead? “Away from an airport Wi-Fi operator, toward a server I run” is a clear trade. “Away from my ISP, toward a company I know nothing about” is also a trade — just make sure you noticed you made it.