One thing worth separating: who serves the results vs who sees your query. DDG and Startpage mostly resell Bing or Google results with the tracking stripped; Brave and Mojeek run their own index. If independence matters, Mojeek is the one with a fully independent crawler, though results are thinner. If privacy matters most, the bigger leak is usually the browser and the accounts you’re logged into while searching, not the engine itself.

Posteo and mailbox.org are the two that come up most in Europe: both have been around for over a decade and run on subscription revenue rather than investors. Posteo doesn’t ask for personal data at signup and lets you pay by bank transfer or even cash in an envelope, so the account isn’t tied to a card. Neither has Proton or Tuta’s built-in end-to-end encryption between users, but both support PGP if you need it.

If anyone wants to check whether their filtering is actually working rather than trusting the dashboard: test a domain that should be blocked with dig or nslookup against the resolver directly, and run a DNS leak test with the VPN on and off. If the blocked domain still resolves, the list isn’t being applied.

For alternatives, the usual split: Quad9 if you only want malware blocking and a non-profit behind it, ControlD or Mullvad DNS for hosted filtering, and AdGuard Home, Pi-hole or Technitium if you want the lists under your own control. Whatever you pick, pin it with DNS-over-HTTPS or DoT so the OS or router can’t silently fall back to the ISP.

The only option that fully meets “doesn’t see my data” is running a model locally. Ollama or LM Studio with one of the open-weight models runs fine on a decent laptop, and nothing leaves your machine. It’s weaker than the big hosted ones for long research questions, but better than people expect for everyday stuff.

If you need hosted, the ones usually mentioned for privacy are Lumo (Proton, says it keeps no logs and encrypts saved chats), Duck.ai (DuckDuckGo proxies your requests to several models without your IP, free) and Le Chat by Mistral (EU, you can turn off training on your chats). None of them is end-to-end encrypted in the strict sense, because the model has to read your prompt to answer it. On the ethics part I’d check each company’s ownership and investors yourself, that changes faster than any list.

The 3 years is almost certainly anti-money-laundering record keeping, not Veriff being greedy. Once a company runs a KYC check it usually has to keep the record for years, and a GDPR deletion request doesn’t override that. So whatever you upload, assume it sits there until the retention period runs out.

Before going that route I’d try two things: email the German shop and ask if they’ll still ship to the US for a surcharge (a lot of smaller shops paused US shipping because of customs paperwork, not because they refuse outright), and check whether a forwarder without ID checks works for a one-off order of cookware. For one pan, uploading a passport scan to a third party feels like a bad trade.

One option nobody mentioned: Compose has a top-level include: (Compose v2.20+). In stack 2 add

include:
  - ../stack1/docker-compose.yml

and gluetun becomes part of the same project, so depends_on: gluetun: condition: service_healthy works again. The catch is that docker compose up/down in stack 2 now manages gluetun too, so it’s best if stack 1 is only gluetun and everything else lives in its own files.

The other half of this is paying for it. If the VPN is tied to your card, the app being pulled from a store is the smaller problem. Mullvad, IVPN and AirVPN all take Monero, and Mullvad and IVPN don’t even ask for an email. Worth it for anyone in a place where the next step after delisting is asking who the customers are.