An app, a tunnel, a server
A VPN is an app. You install it, sign in, and tap connect. Traffic leaving your device is encrypted until it reaches a server the VPN company operates. That server opens websites for you and sends the replies back down the same tunnel.
Websites see the VPN server's address. Your internet provider sees a connection to the VPN company, and how much data moves, and not the list of pages inside the tunnel.
Who can still see what
The VPN company can see that your account is online and which of its servers you used. Any site you log into still knows that account is yours. A VPN changes the network address attached to your traffic. Signing in to a service puts your name back on that visit.
Think of a private road between your house and a post office in another city. People on your street cannot read the mail while it is on that road. The post office still handles it. Here, the post office is the VPN company.
What the encryption covers
Encryption means the contents of the tunnel are scrambled for anyone listening on the local network. It is the same kind of protection as the padlock in a browser address bar, applied to the path between you and the VPN server. The sites you visit may encrypt their own stretch of the trip as well. The two layers cover different parts of the route.
If the app says connected and a public-address check still shows your usual address, the tunnel is not carrying your traffic. Disconnect, quit the app, and connect again before you trust the status icon.