> You live in the US, right? And you pirate stuff, right? Or maybe you Google things that would get you put on the TSA no-fly list? Well, with a VPN, it won’t be your US ISP that has access to your traffic—and then has to give it over to the MPAA and the NSA—but rather a VPN company from some foreign country, who has no such obligations. Sure, they can sell your data to anyone they like... but it’s not like the USGOV or the various media cartels are buying data. If they can’t compel it for free, they don’t bother (and they certainly couldn’t fully trust data sourced from a company headquartered in a non-allied country anyway, so why would they bother?) Someone somewhere might know about your VPN traffic, but it probably won’t be someone out to get you. Just someone out to sell you stuff.
Or, if you prefer:
> You live in Hong Kong, right? And you have some vocal opinions about Chinese sovereignty, right? Well, with a VPN, it’s not the Chinese government that sees your traffic, but rather....
So using a VPN comes down to the fair gamble that someone who promises not to log and use your data is possibly better than the guys who definitely log and use it.
No, it isn't.
You don't have to use "bank-grade", "military-grade", etc. in your marketing. They don't actually mean anything, and only serve as a red flag for "we don't know what the fuck we're doing".
You can use almost-equally meaningless phrases like "state of the art", "industry standard", etc.
You can sell on a "proven track record" of not selling out to data brokers or yielding to government search warrants (although that mostly hinges on "never been subpoenaed" rather than "resisted a subpoena" in practical terms).
There's lots of other paths to take besides using "${DUMB}-grade" in your marketing copy. Saying "that's just how it goes" is yielding to a lazy cop-out with another lazier cop-out. It absolutely isn't just how it goes.
Nord also says they never hold logs, and locate in Panama to avoid gov't subpoenas. It's not either/or. You can (should) put the technical information on a 'security' page for the people who know enough to find it and read it.
Even worse the VPN provider is usually operating from some country with much less regulation regarding privacy. If it were revealed that some ISP here in Germany is sniffing traffic and selling your data, shit would hit the fan, but if your trusty VPN provider from whoknowswhere does this, good luck going after them.