A few separate reasons usually sit behind that recommendation:

• Track record. DDG has been around since 2008 with the same simple model: ads matched to the search term, not to a profile of you. Brave Search only launched in 2021.
• Trust in the company. Brave’s browser was caught in 2020 quietly adding its own affiliate codes to some crypto exchange URLs, and its ad model is tied to its own token. Plenty of people never forgave that. DDG had its own stumble in 2022 (its browser allowed some Microsoft trackers under a search deal, since reversed), so neither is spotless.
• It works anywhere. DDG is just a search engine you can set in any browser; Brave Search is often conflated with the Brave browser.

The point in Brave’s favour is independence: it runs its own index, while DDG’s results mostly come from Bing. If that matters most to you, Brave Search or Mojeek is the better pick. For someone just starting to de-google, either one is a big step up, and the browser and the accounts you stay logged into matter more than which of the two you choose.

You’re right, thanks for the correction. Mullvad retired its public encrypted DNS servers on November 2 and is sponsoring Quad9 instead, so scratch it from that list. DNS still works inside their VPN tunnel, but as a standalone resolver it’s gone, and old iOS/macOS profiles pointing at it need replacing. Quad9 is the drop-in swap they recommend.

For a replacement lid it might not need the German shop at all. Spare parts often go through a different channel than the retail store: most of the big German cookware brands have a US distributor or an official parts page, and their customer service will usually tell you which US dealer stocks the part if you give them the model number from the base. eBay.de sellers that use eBay’s international shipping are another option, since the seller ships to a domestic hub and you never deal with a forwarder.

One thing worth separating: who serves the results vs who sees your query. DDG and Startpage mostly resell Bing or Google results with the tracking stripped; Brave and Mojeek run their own index. If independence matters, Mojeek is the one with a fully independent crawler, though results are thinner. If privacy matters most, the bigger leak is usually the browser and the accounts you’re logged into while searching, not the engine itself.

Posteo and mailbox.org are the two that come up most in Europe: both have been around for over a decade and run on subscription revenue rather than investors. Posteo doesn’t ask for personal data at signup and lets you pay by bank transfer or even cash in an envelope, so the account isn’t tied to a card. Neither has Proton or Tuta’s built-in end-to-end encryption between users, but both support PGP if you need it.

If anyone wants to check whether their filtering is actually working rather than trusting the dashboard: test a domain that should be blocked with dig or nslookup against the resolver directly, and run a DNS leak test with the VPN on and off. If the blocked domain still resolves, the list isn’t being applied.

For alternatives, the usual split: Quad9 if you only want malware blocking and a non-profit behind it, ControlD or Mullvad DNS for hosted filtering, and AdGuard Home, Pi-hole or Technitium if you want the lists under your own control. Whatever you pick, pin it with DNS-over-HTTPS or DoT so the OS or router can’t silently fall back to the ISP.

The only option that fully meets “doesn’t see my data” is running a model locally. Ollama or LM Studio with one of the open-weight models runs fine on a decent laptop, and nothing leaves your machine. It’s weaker than the big hosted ones for long research questions, but better than people expect for everyday stuff.

If you need hosted, the ones usually mentioned for privacy are Lumo (Proton, says it keeps no logs and encrypts saved chats), Duck.ai (DuckDuckGo proxies your requests to several models without your IP, free) and Le Chat by Mistral (EU, you can turn off training on your chats). None of them is end-to-end encrypted in the strict sense, because the model has to read your prompt to answer it. On the ethics part I’d check each company’s ownership and investors yourself, that changes faster than any list.

The 3 years is almost certainly anti-money-laundering record keeping, not Veriff being greedy. Once a company runs a KYC check it usually has to keep the record for years, and a GDPR deletion request doesn’t override that. So whatever you upload, assume it sits there until the retention period runs out.

Before going that route I’d try two things: email the German shop and ask if they’ll still ship to the US for a surcharge (a lot of smaller shops paused US shipping because of customs paperwork, not because they refuse outright), and check whether a forwarder without ID checks works for a one-off order of cookware. For one pan, uploading a passport scan to a third party feels like a bad trade.

One option nobody mentioned: Compose has a top-level include: (Compose v2.20+). In stack 2 add

include:
  - ../stack1/docker-compose.yml

and gluetun becomes part of the same project, so depends_on: gluetun: condition: service_healthy works again. The catch is that docker compose up/down in stack 2 now manages gluetun too, so it’s best if stack 1 is only gluetun and everything else lives in its own files.

The other half of this is paying for it. If the VPN is tied to your card, the app being pulled from a store is the smaller problem. Mullvad, IVPN and AirVPN all take Monero, and Mullvad and IVPN don’t even ask for an email. Worth it for anyone in a place where the next step after delisting is asking who the customers are.