Leave nothing for the network to read.
Your traffic is sealed on your device with WireGuard keys you generate, then exits through a node run by an independent operator. The café, your ISP, and the sites you visit see noise and a borrowed address — not you.
See private browsing