Yes that or cash in the mail might be reasonable options for paying.
I guess my problem is more that you are trusting an overall unknown entity with your real ip, which is only one step away from your real info for someone who is able to compel that information from the VPN provider in the first place.
The VPN account is directly tied to you by your payment details. Also most VPN services that claim to "not keep any logs whatsoever" are just a 3 page website with not much information. Maybe that's safer since they are low profile, or maybe it isn't? I honestly have no idea and I wish I did.
It feels like your just trusting some random person to not mess with you.
Bit off topic but you might want to 301 redirect to the right page instead of just disallowing search engines on your subdomains. This way if someone links to the wrong page you will still get the link juice.
I might have misunderstood that first bit though, since it looks like you do redirect anyway.
A problem I have had with these frameworks is that they all sound great on the surface but when you start using them you run into issues or missing features that are important to you and sometimes there's nothing you can do about it.
Haxe does look great and for this particular case I wonder how Haxe NME's performance compares to the lua frameworks like Corona and Gideros for mobile development specifically.
I'm glad I finally (mostly) have a grip on it all but boy did it take a while.