Most people who recommend a VPN have never actually looked at the field. They saw an ad, a sponsored video, or a “top 10 VPNs” list that was really a top 10 affiliate-commission list, and they passed it along. We did the unglamorous thing instead. We evaluated the whole market: 211 VPN providers, one at a time, against the criteria that actually matter.

What we found is why we are so specific about the VPNs we put in front of you, and why “just get a VPN” is some of the worst privacy advice going around.

The field is mostly poison

Here is what 211 providers looked like once we stopped reading the marketing and started checking the facts.

91 percent had never had an independent security audit. They are asking you to trust them with the single most sensitive thing you own, every packet you send, on nothing but their word.

58 percent were logging activity despite claiming they don’t. The “no-logs policy” is the most abused phrase in this industry. More than half the providers making that promise were quietly keeping records anyway.

57 percent operate from Five Eyes countries, the intelligence-sharing bloc where a provider can be legally compelled to hand over data and, often, gagged from telling you it happened. A no-logs promise means little when the law can force logging to start.

88 percent publish no transparency report. They will not even tell you, in aggregate, how many times a government asked for user data.

31 percent carried what we call black flags: owned by opaque Chinese holding companies, shipping actual malware, or operating as outright scams. Roughly one in three.

And nearly half the market is “free.” A VPN sees all of your traffic, and running that infrastructure costs real money. If you are not paying, the business model is selling the very data you installed the app to protect. Free VPN is not a gift. It is a data-collection operation with a friendly icon.

Add it up and the vast majority of VPNs on the market do not protect your privacy. Many of them actively make it worse.

A VPN moves your trust. It does not remove it.

This is the thing the ads never say. A VPN does not make you trustless. It takes the trust you were placing in your internet provider and moves it to the VPN company. Your ISP can no longer see what you do; the VPN can.

So the only question that matters is whether the company you moved your trust to is more trustworthy than the ISP you moved it from. Pick a logging, data-selling, Five-Eyes, unaudited provider and you did not gain privacy. You handed the same surveillance to a worse custodian and paid for the privilege. Which VPN you use matters far more than whether you use one.

That is why we refuse to be casual about it.

The bar, and the four that cleared it

To earn a recommendation as a privacy VPN, a provider had to clear all of the following, not most:

• A verified no-logs posture, ideally proven rather than promised, by an audit or by a real-world event where authorities came looking and found nothing.
• Independent security audits, repeated, by credible outside firms.
• A privacy-respecting jurisdiction, outside the reach of the worst compelled-disclosure regimes.
• Real transparency, including published reports on government requests.
• A clean, honest business model, where you are the customer, not the product.

Out of 211 providers, exactly four cleared that bar: Mullvad, IVPN, Proton VPN, and Windscribe. Any of the four is a defensible choice. Two of them are in Bazaar, our app store.

The two privacy VPNs: Mullvad and IVPN

These answer one specific question: how do I keep my traffic private from my ISP and my IP hidden from the sites I visit? Of the four that survived, these are the two we would hand a friend with no asterisks, because they ask you to trust them the least. They collect the least and prove the most.

Mullvad. The closest thing to trustless a commercial VPN gets. You do not give them an email, a name, or any personal detail; you get a random account number, and that is your entire identity. You can pay with cash mailed in an envelope, or crypto, so there is no financial trail tying the account to you. They have been independently audited repeatedly. And they hold the one credential no marketing budget can buy: when authorities showed up to seize customer data, there was nothing to take, because the no-logs policy is real and the data simply does not exist. Flat pricing, open-source apps, no upsells.

IVPN. The same school of thought, arguably even louder about it. You can sign up with no personal information at all. They are independently audited, publish transparency reports, and operate from a jurisdiction chosen for privacy rather than convenience. The people who run it are openly hostile to the surveillance-advertising economy, and the product reflects that: minimal data collection by design, not a feature they might quietly walk back next quarter.

We ship both, because redundancy in trust is itself a feature. Two audited, no-logs, anonymous-signup providers from different jurisdictions means you are not betting everything on one company staying good forever.

The third is a different animal: Tailscale

Here is where people get confused, so let us be clear. Tailscale is also in Bazaar, and it is not competing with Mullvad and IVPN. It answers a completely different question: how do I connect my own devices into a private, encrypted network that only I can reach?

Tailscale is a WireGuard-based mesh VPN. Instead of routing you through a provider’s shared servers to hide in a crowd, it stitches your own devices together, your phone, a laptop, a server at home, a device in the field, into a single private network where they can all reach each other securely no matter where they physically sit. It is how you get to your home network from the road, run a closed and isolated network for a team, or reach your own infrastructure without ever exposing it to the public internet.

And critically for how we think, it can be self-hosted. The coordination piece that ties the mesh together does not have to be Tailscale’s servers; with the open-source Headscale, you run that yourself, so your private network answers to you and no one else. That is the same principle we apply everywhere: where you can own the infrastructure, own it. It is also the productized, far easier version of rolling your own WireGuard on a VPS, same control, a fraction of the setup.

So you might use Mullvad on coffee-shop WiFi to keep your browsing private, and Tailscale to reach the server in your office, on the same phone, the same day, for entirely different reasons. Shipping all three means you are never forced to misuse one for a job it was not built to do.

The honest limits, because we always say them

A VPN, any of them, is a specific tool, not a cloak of invisibility. Two things we have written about at length and will repeat here.

A VPN does not make you anonymous. It hides your traffic from your ISP and your IP from the websites you visit, but your logins, your browser fingerprint, and your behavior still identify you. Anonymity is a much bigger project than a tunnel.

And a VPN does not hide your phone’s hardware identity, like the IMEI your carrier sees. That lives at a layer no VPN touches. Anyone selling a VPN as a fix for that is selling you something that does not exist.

Used for what they are actually for, a good privacy VPN and a good mesh VPN are both genuinely valuable. Expected to be magic, they will let you down.

Why all three are already in the store

We put Mullvad, IVPN, and Tailscale in Bazaar so you do not have to run the 211-provider gauntlet yourself, and so you are never tempted to grab a random VPN APK off the internet, which is exactly how a third of that market gets malware onto phones. The two we would trust with our traffic and the one we would trust with our own network are right there, vetted, waiting. We did the hard, boring evaluation once, so you get the answer instead of the homework.

If you want to talk through which of the three fits your situation, or you have a use case that calls for something more bespoke, we are happy to get into it. Email hello@spicycorp.com, or book a call.