At least there have been some public and external audits that brings up the trust a bit, if you trust that those external companies are honest and putting their reputation on the line.

List of the audits can be found here: https://mullvad.net/en/blog/tag/audits/

Government investigations pursue lots of avenues unlikely to be fruitful. It's basic due diligence to check all the boxes; you don't say "standard procedure is to issue a warrant, but we'll make an exception to our process in this case because their website suggests it won't get any data, plus they hired an auditor."

> Mullvad could have been, and maybe even still is, lying about how they operate

Could they? Sure.

Do they have anything on me?

    * One BTC transfer
    * IPs where I'm connecting from (if they are lying and storing them)
    * My traffic (if they are lying and storing it)
    * My unencrypted traffic (if they are lying and storing it)

Do they have ... on me?

    * Email? - nope
    * Phone number? - nope
    * Credit card? - nope
    * My first name, family name? - nope
    * My address? - nope
    * My mother's maiden name? - nope

Because I never provided it to them because they never asked for them.

Might I suggest for the future: https://vpn.sovereign.engineering

You can pay a Bitcoin lightning invoice on this site and get a redeemable Mullvad voucher instantly. Extremely convenient. Since you've only done 1 BTC transaction, I assume it was a large one for lots of time. However, when your time runs out, this option is great. It's an extra layer of privacy and you don't have to wait for the transaction to settle on chain.

Monero is even better

Did you obtain the BTC that you used for the purchase from an exchange that requires PII?

Exchange has my CC number and the 'card holder' (though I never put my name there, lol). A non-business card is probably the most easy way to identify someone globally.

If someone comes to exchange - they could identify me (and they can just tap their server to listen to email which do have all the transaction info, including CC# in the plaintext, lol).

To establish a correlation between my wallet and Mullvad account someone needs to find that transaction in Mullvad customer data. Which - they claim they don't have.

So yes, someone can identity what I bought services from Mullvad and... nothing more?

Unless you're using another VPN/proxy/Tor/... to connect to the VPN, the IP where you're connecting from (respectively the full 4-tuple including source/destination port) likely does identify your address.

Of course. It doesn't help what I'm getting pretty much the same IPs from my provider.

Double (triple|quad) hop, tied to different entities is necessary if you want at least plausible deniability. Thankfully I don't do things what may be of the interest of someone who can raid Mullvad offices.

But I recently discovered a VPS provider who only needs an email address to confirm an order, so it can be used as a bootstrap for a something pretty anonymous. Still needs an email, but as I said in some other comment recently, you can do that (if you are okay with leaving some traces) with a Google device with WiFi only capability.