which domain registrars actually protect whois privacy?

Every registrar claims WHOIS privacy, but most will hand over your data when served with a court order or subpoena.

The question is which registrars are in jurisdictions that don't cooperate with the authorities you're worried about.

Namecheap and GoDaddy are in the US — they will comply with US court orders. Njalla and Shinjiru are in more protective jurisdictions.

whois privacy is never absolute

Depends what you're running, but I use Njalla for domains that need actual privacy. They're in Nevis and don't cooperate with foreign requests unless it's a serious criminal matter.

How long have you been using them?

About 3 years. No issues so far.