If you want a simple explanation why he couldn’t spy:
Imagine that your internet traffic is a bunch of letters. HTTP are postcards. You can read the message and destination both. HTTPS are envelopes. You cannot read the message, but you can see the destination.
When using VPN, you stick every letter/postcard in another envelope, addressed to the VPN company’s address. They unpack the letter, set themselves as the return address, and send it on.
Your friend could previously look at the outside of your letters, and see who you’re sending to, and how much. Now, they can only see you’re sending to the VPN company, which isn’t helpful. (In theory, they can see the volume of data, but there isn’t much they can learn with just that).
If you want a simple explanation why he couldn’t spy:
Imagine that your internet traffic is a bunch of letters. HTTP are postcards. You can read the message and destination both. HTTPS are envelopes. You cannot read the message, but you can see the destination.
When using VPN, you stick every letter/postcard in another envelope, addressed to the VPN company’s address. They unpack the letter, set themselves as the return address, and send it on.
Your friend could previously look at the outside of your letters, and see who you’re sending to, and how much. Now, they can only see you’re sending to the VPN company, which isn’t helpful. (In theory, they can see the volume of data, but there isn’t much they can learn with just that).