> That's already a huge breach in comparison to mullvad privacy page.

And the "3 data points, that's it" of the blog post

Those data points refer to what is stored in the database and is tied to your 32 character credential.

Web server logs were not tied to user credentials in any way.

IPs are PII. They can be tied to an identity.

	▲	organsnyder 2 days ago \| parent [-]
		Even user agents are often specific enough to be considered PII.