‘Super app’ aimed at UK students uses servers owned by Chinese firm on US blacklist

A new messaging and payment “super app” marketed at British students uses servers owned by a Chinese company that has been put on a US military blacklist for its alleged affiliation to the People’s Liberation Army.

ZyMix, which is being pushed on university campuses as the UK’s first super app designed “for gen Z”, combining chat, payments and community features, has a contract with a German-based subsidiary of Tencent Holdings, a Chinese conglomerate in Shenzhen.

Tencent Holdings was added in January 2026 to the US Department of Defense’s (DoD) list of Chinese military companies, which is formally known as the section 1260H list.

The citation on the DoD list says that the company, which is a gaming and social media conglomerate, is indirectly affiliated to the Chinese People’s Liberation Army.

The blacklist is part of a US attempt to counteract what it regards as Beijing’s efforts to increase its military power by using technology from Chinese firms, universities and research programmes.

The DoD is prohibited from entering into, renewing or extending contracts for goods, services or technology with any entity on the list although wider sanctions are not automatic.

A Tencent spokesperson said: “Tencent’s inclusion on this list is clearly a mistake. We are not a military company or supplier. Unlike sanctions or export controls, this listing has no impact on our business. We will nonetheless work with the Department of Defense to address any misunderstanding.”

China’s footprint in higher education in the UK has become a controversial issue. MI5 recently warned British universities to cut ties with the China General Technology Research Institute.

The domestic intelligence service claimed it was secretly channelling funding from Beijing’s intelligence apparatus to UK-linked academics to improve the technical espionage capabilities of China’s ministry of state security.

The link between the Chinese-owned infrastructure and ZyMix was initially disclosed in the company’s privacy policy at the time of its launch last week.

The document, which is legally required, said that Tencent (Frankfurt) stored user-generated content and messages. After the Guardian approached the company, the privacy policy was rewritten and mention of Tencent was removed.

The policy now states that users’ personal data is stored and processed primarily in the United Kingdom and the EU, adding that “some of our service providers are located in other countries, including the United States”.

It goes on to say that “auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data, such as technical statistics, licence validation when the app starts”.

A spokesperson said: “As a newly launched startup, we are updating our privacy notice as we develop our services, including clarifying that Tencent, Twilio and the other providers concerned are used solely for performance testing.”

The spokesperson added: “Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services, rather than as the provider that stores ZyMix user data. We take our obligations under UK data protection law seriously.”

The new privacy policy invites those who wish to know the identity of their suppliers to request the information from the company.

In response to a request from the Guardian, Tarique Ghaffur, a former assistant commissioner at the Metropolitan police, who described himself as a security consultant for ZyMix, responded.

He said: “We have reviewed your request as against our private privacy [sic] you mentioned. Unfortunately, at the present time for reasons of commercial confidentiality, contractual obligations and legal privileges, we are not able to provide you with the requested information.”

Fraser Sampson, a professor of security and national governance and formerly the UK’s biometrics and surveillance camera commissioner, said he was “sceptical when ‘commercial confidentiality’ arguments are used to duck basic policy questions and amending policy on the fly is never reassuring”.

He added: “When companies ask us for our personal data, they should expect us to ask them where it’s being kept, for what purpose(s) and who they’re going to share it with – and be prepared to answer fully.”

Sam Dunning, the director of the UK-China Transparency NGO, said: “There are serious questions about whether ZyMix have taken due care before launching this product.”

A spokesperson for ZyMix said: “Whilst still in its beta stage, the ZyMix app has been developed to fully comply with all UK data, privacy and financial regulations.”

ZyMix is heavily targeting the university market and is offering £200 to £400 a month to people who agree to be brand ambassadors on campuses. Staff roles have also been advertised in the UK by ZyMix for Mandarin-speaking applicants.

One advert on LinkedIn for the job of operations manager (Mandarin speaking) required “excellent written and verbal communication skills in both English and Mandarin (required for daily communication with the China team)”.

Separately, a distinct company appeared to be recruiting on behalf of ZyMix on WeChat, the Chinese instant messaging service, saying: “The product, R&D, design and testing team is in Greater China, with branch-company bases covering: Taipei / Shenzhen / Guangzhou / Hangzhou / Chengdu / Zhengzhou.”

Ghaffur said that Flicknmix, the UK company that publishes the ZyMix app, “does not have any subsidiaries or branch offices in China. Our aim is to create opportunities within the UK”. A spokesperson for ZyMix described it as “British born”.