What ZyMix offers students

ZyMix combines chat, payments and community features and is promoted as the UK's first super app designed for gen Z, aimed at British university students. As part of its university market push, ZyMix is offering £200 to £400 a month to people who agree to act as campus brand ambassadors.

The Tencent link and the US list

ZyMix holds a contract with a German-based subsidiary of Tencent Holdings, a Chinese conglomerate headquartered in Shenzhen. In January 2026, the US Department of Defense added Tencent to its list of Chinese military companies, formally the section 1260H list. The citation says the gaming and social media conglomerate is indirectly affiliated to the Chinese People's Liberation Army.

The blacklist forms part of a US effort to counteract what it regards as Beijing's efforts to increase its military power through technology from Chinese firms, universities and research programmes. The DoD is prohibited from entering into, renewing or extending contracts with any entity on the list, although wider sanctions are not automatic.

Tencent has rejected the designation. A spokesperson said: "Tencent's inclusion on this list is clearly a mistake. We are not a military company or supplier." The spokesperson added that, unlike sanctions or export controls, the listing has no impact on its business, saying: "We will nonetheless work with the Department of Defense to address any misunderstanding."

A privacy policy that changed

ZyMix's link to Chinese-owned infrastructure was disclosed in the privacy policy published at its launch last week. That legally required document said Tencent (Frankfurt) stored user-generated content and messages. After the Guardian approached the company, the privacy policy was rewritten and the mention of Tencent was removed.

The new policy states that user personal data is stored and processed primarily in the United Kingdom and the EU, with some service providers located in other countries including the US. It says auxiliary infrastructure providers hosted in the EU receive only encrypted user messages and limited technical data, such as technical statistics and licence validation. Users who wish to know the identity of their suppliers are invited to request the information from the company.

Questions over the company behind the app

A ZyMix spokesperson said the company is updating its privacy notice and clarifying that Tencent, Twilio and the other providers concerned are used solely for performance testing. The spokesperson said: "Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services," adding that the provider is not the one storing ZyMix user data and that UK data protection obligations are taken seriously. Another spokesperson described the company as "British born".

Critics and outside figures have raised concerns:

• •Tarique Ghaffur, a former Metropolitan police assistant commissioner who described himself as a ZyMix security consultant, said that "for reasons of commercial confidentiality, contractual obligations and legal privileges, we are not able to provide you with the requested information".
• •Fraser Sampson, professor of security and national governance and former UK biometrics and surveillance camera commissioner, said he is sceptical when 'commercial confidentiality' arguments are used to duck basic policy questions, and that amending policy on the fly is never reassuring.
• •Sam Dunning, director of the UK-China Transparency NGO, said: "There are serious questions about whether ZyMix have taken due care before launching this product."

Questions have also surfaced about the app's development footprint. A LinkedIn advert for a Mandarin-speaking operations manager required "excellent written and verbal communication skills in both English and Mandarin (required for daily communication with the China team)". Separately, a distinct company appeared to be recruiting on ZyMix's behalf on WeChat, saying the product, R&D, design and testing team is in Greater China.

That recruitment notice listed branch bases in Taipei, Shenzhen, Guangzhou, Hangzhou, Chengdu and Zhengzhou. Ghaffur responded that Flicknmix, the UK company publishing the ZyMix app, "does not have any subsidiaries or branch offices in China. Our aim is to create opportunities within the UK".

The concerns land against a wider backdrop: MI5 recently warned British universities to cut ties with the China General Technology Research Institute, claiming it was secretly channelling funding from Beijing's intelligence apparatus to UK-linked academics.

Sampson put the underlying principle plainly:

ZyMix remains in beta. Its spokesperson says the app "has been developed to fully comply with all UK data, privacy and financial regulations", while the company updates its privacy notice.