UK student super app ZyMix uses servers from US-blacklisted Tencent

Privacy policy named Tencent before being rewritten after Guardian inquiry

ZyMix, a messaging and payment “super app” launched last week and marketed to British university students, runs on infrastructure owned by Tencent Holdings, the Shenzhen-based gaming and social-media conglomerate the US Department of Defense placed on its section 1260H list of Chinese military companies in January 2026. The connection surfaced in the app’s launch privacy policy and was removed from the document once questions were raised.

The DoD’s section 1260H list identifies companies the department alleges are affiliated to the People’s Liberation Army. The blacklist is part of a US attempt to counteract what it regards as Beijing’s efforts to increase its military power by using technology from Chinese firms, universities and research programmes. Inclusion does not impose sanctions automatically, but the DoD is prohibited from entering into, renewing, or extending contracts for goods, services, or technology with listed entities. The citation for Tencent says the company is “indirectly affiliated to the Chinese People’s Liberation Army.” A Tencent spokesperson called the inclusion “clearly a mistake,” saying: “Tencent’s inclusion on this list is clearly a mistake. We are not a military company or supplier. Unlike sanctions or export controls, this listing has no impact on our business. We will nonetheless work with the Department of Defense to address any misunderstanding.”

The link between the Chinese-owned infrastructure and ZyMix first appeared in the privacy policy at the time of the app’s launch. The document, which is legally required, said that Tencent (Frankfurt) stored user-generated content and messages. After The Guardian approached the company, the policy was rewritten and the mention of Tencent was removed. It now states that users’ personal data is stored and processed primarily in the United Kingdom and the EU, adding that “some of our service providers are located in other countries, including the United States.” It goes on to say that “auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data, such as technical statistics, licence validation when the app starts.”

A ZyMix spokesperson said: “As a newly launched startup, we are updating our privacy notice as we develop our services, including clarifying that Tencent, Twilio and the other providers concerned are used solely for performance testing.” The spokesperson added: “Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services, rather than as the provider that stores ZyMix user data. We take our obligations under UK data protection law seriously.” The rewritten policy invites users who wish to know the identity of their suppliers to request the information from the company.

In response to a request from The Guardian, Tarique Ghaffur — a former assistant commissioner at the Metropolitan police who describes himself as a security consultant for ZyMix — declined to identify the app’s suppliers. He said: “We have reviewed your request as against our private privacy [sic] you mentioned. Unfortunately, at the present time for reasons of commercial confidentiality, contractual obligations and legal privileges, we are not able to provide you with the requested information.”

Fraser Sampson, a professor of security and national governance and formerly the UK’s biometrics and surveillance camera commissioner, said he was “sceptical when ‘commercial confidentiality’ arguments are used to duck basic policy questions and amending policy on the fly is never reassuring.” He added: “When companies ask us for our personal data, they should expect us to ask them where it’s being kept, for what purpose(s) and who they’re going to share it with – and be prepared to answer fully.” Sam Dunning, the director of the UK-China Transparency NGO, said: “There are serious questions about whether ZyMix have taken due care before launching this product.”

ZyMix is heavily targeting the university market and is offering £200 to £400 a month to people willing to serve as brand ambassadors on campuses. Staff roles have also been advertised in the UK by ZyMix for Mandarin-speaking applicants. One advert on LinkedIn for the job of operations manager (Mandarin speaking) required “excellent written and verbal communication skills in both English and Mandarin (required for daily communication with the China team).” Separately, a distinct company appeared to be recruiting on behalf of ZyMix on WeChat, the Chinese instant messaging service, saying: “The product, R&D, design and testing team is in Greater China, with branch-company bases covering: Taipei / Shenzhen / Guangzhou / Hangzhou / Chengdu / Zhengzhou.”

Ghaffur said that Flicknmix, the UK company that publishes the ZyMix app, “does not have any subsidiaries or branch offices in China. Our aim is to create opportunities within the UK.” A spokesperson for ZyMix described it as “British born.”

MI5 recently warned British universities to cut ties with the China General Technology Research Institute. The domestic intelligence service alleges the institute has been secretly channelling funding from Beijing’s intelligence apparatus into UK-linked academics to improve the technical espionage capabilities of China’s ministry of state security.

A spokesperson for ZyMix said: “Whilst still in its beta stage, the ZyMix app has been developed to fully comply with all UK data, privacy and financial regulations.”