I was using a free VPN to access a Germany-only site and forgot I left it on. Then I used my credit card to make online purchases; now I'm concerned about whether who ever runs the free VPN knows my credit card number. Is it possible even if I entered the card info into a https page?
Win 7 64-bit. IE 8.
If your online purchase was made on a secure site (using https), you shouldn't have to worry. HTTPS encrypts everything between the website and your browser, which your VPN provider cannot decrypt.
Some websites have the bad habit of using https only during the checkout process, and using regular http for everything else (including logging in). Your VPN provider can, in theory, exploit this. If you logged in to a website that saves sensitive info (like your personal details or credit card information), you might want to change your password.
The last step out from VPN to the server is unencrypted if you did not care to post your card number over https://.
It is always good to read the tourist guide before walking slippery path https://www.eff.org/https-everywhere
Note1
Everything that you posted over unencrypted connection (not having https://) is visible on other end of VPN or TOR (and in path between the other end and site you posted it)
In case you used https:// it stays between you and site in the other end, pants dry
