I am not affiliated with Mullvad VPN in any capacity and I have nothing to disclose, lol.

Mullvad VPN does not even offer a renewing subscription, that I know of, and I’m almost entirely certain that they used to. Their VPN service costs less than $5/month (USD) if you get their card off Amazon that’s good for a year, and that is literally a physical card sent through the mail—the kind you have to scratch off on the back to get to the number underneath, in other words—and so at least AFAIK, there’s no possible way for whichever unique card you happen to end up getting sent in the mail, to be traced directly to that specific transaction on Amazon, even if you paid for it using your credit/debit card, and directly associated that purchase with your bank account in so doing. It’s even better than that if you pay them by means far less traceable to begin with, of course, and they have those options as well. In fact, they prefer doing it that way as opposed to credit card purchases, even of physical cards through Amazon, IIRC. At least AFAIK, they don’t even accept any form of payment directly traceable to a bank account on their own website, for every obvious reason.

One thing I really like about (using) it, and I have no idea what other VPNs would also do something like this, if any: it sets up a SOCKS5 proxy for you internally, and you can use that anywhere you need a killswitch properly, meaning to make said application physically unable to resolve hostnames in the event of your connection to the VPN being interrupted for some reason. I’m also pretty sure you can use their DNS-over-HTTPS no matter what, even if you don’t alruady use their VPN service. Anyway, especially if you already do, though, I always figure it’s never a bad to use just use the same provider everywhere you can: using their encrypted DNS wherever possible, in addition to using their proxy wherever possible, in addition to using their VPN anyway. I do that, and I also use multi-hop, which hides my enjoyment of innocuous websites everyone else also uses even further. It’s simply a technical matter that doing all of that will make damned near everything—excluding, of course, abject OPSEC failure, browser fingerprinting, etc.—way more difficult to trace than it otherwise would be. It has to be. I didn’t say “impossible” because I never would, and again, it’s never gonna protect anyone from themselves because it can’t. It’s still just so many consecutive layers of obfuscation contrary to the best interest of the boogeyman, especially for the price, that if I didn’t have immediate access to $60 in order to buy another year’s worth of Mullvad VPN, or immediate access to Mullvad VPN, I would literally beg and borrow, figuratively steal, and otherwise aquire.