The Guardian
· collected 2026-10-13 · by Daniel Boffey Chief reporter
A new messaging and payment “super app” marketed at British students uses servers owned by a Chinese company that has been put on a US military blacklist for its alleged affiliation to the People’s Liberation Army.
asserted
that → market → Army
ZyMix, which is being pushed on university campuses as the UK’s first super app designed “for gen Z”, combining chat, payments and community features, has a contract with a German-based subsidiary of Tencent Holdings, a Chinese conglomerate in Shenzhen.
asserted
which → push → Shenzhen
Tencent Holdings was added in January 2026 to the US Department of Defense’s (DoD) list of Chinese military companies, which is formally known as the section 1260H list.
asserted
which → add → list
The citation on the DoD list says that the company, which is a gaming and social media conglomerate, is indirectly affiliated to the Chinese People’s Liberation Army.
asserted
which → say → Army
The blacklist is part of a US attempt to counteract what it regards as Beijing’s efforts to increase its military power by using technology from Chinese firms, universities and research programmes.
asserted
it → counteract → firms
The DoD is prohibited from entering into, renewing or extending contracts for goods, services or technology with any entity on the list although wider sanctions are not automatic.
A Tencent spokesperson said: “Tencent’s inclusion on this list is clearly a mistake.
asserted
inclusion → prohibit → list
Unlike sanctions or export controls, this listing has no impact on our business.
asserted
listing → have → business
We will nonetheless work with the Department of Defense to address any misunderstanding.”
asserted
We → work → misunderstanding
China’s footprint in higher education in the UK has become a controversial issue.
asserted
footprint → become → UK
MI5 recently warned British universities to cut ties with the China General Technology Research Institute.
asserted
MI5 → warn → Institute
The domestic intelligence service claimed it was secretly channelling funding from Beijing’s intelligence apparatus to UK-linked academics to improve the technical espionage capabilities of China’s ministry of state security.
asserted
it → claim → security
The link between the Chinese-owned infrastructure and ZyMix was initially disclosed in the company’s privacy policy at the time of its launch last week.
asserted
link → own → launch
The document, which is legally required, said that Tencent (Frankfurt) stored user-generated content and messages.
asserted
Tencent → require → content
After the Guardian approached the company, the privacy policy was rewritten and mention of Tencent was removed.
asserted
mention → approach → Tencent
The policy now states that users’ personal data is stored and processed primarily in the United Kingdom and the EU, adding that “some of our service providers are located in other countries, including the United States”.
asserted
some → state → States
It goes on to say that “auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data, such as technical statistics, licence validation when the app starts”.
asserted
app → go → statistics
A spokesperson said: “As a newly launched startup, we are updating our privacy notice as we develop our services, including clarifying that Tencent, Twilio and the other providers concerned are used solely for performance testing.”
asserted
Tencent → say → testing
The spokesperson added: “Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services, rather than as the provider that stores ZyMix user data.
asserted
that → add → data
We take our obligations under UK data protection law seriously.”
asserted
We → take → law
The new privacy policy invites those who wish to know the identity of their suppliers to request the information from the company.
asserted
who → invite → company
In response to a request from the Guardian, Tarique Ghaffur, a former assistant commissioner at the Metropolitan police, who described himself as a security consultant for ZyMix, responded.
asserted
who → describe → ZyMix
He said: “We have reviewed your request as against our private privacy [sic] you mentioned.
asserted
you → say → privacy
Unfortunately, at the present time for reasons of commercial confidentiality, contractual obligations and legal privileges, we are not able to provide you with the requested information.”
asserted
we → provide → information
Fraser Sampson, a professor of security and national governance and formerly the UK’s biometrics and surveillance camera commissioner, said he was “sceptical when ‘commercial confidentiality’ arguments are used to duck basic policy questions and amending policy on the fly is never reassuring”.
asserted
amending → say → fly
He added: “When companies ask us for our personal data, they should expect us to ask them where it’s being kept, for what purpose(s) and who they’re going to share it with – and be prepared to answer fully.”
asserted
they → add → it
Sam Dunning, the director of the UK-China Transparency NGO, said: “There are serious questions about whether ZyMix have taken due care before launching this product.”
asserted
ZyMix → say → product
A spokesperson for ZyMix said: “Whilst still in its beta stage, the ZyMix app has been developed to fully comply with all UK data, privacy and financial regulations.”
asserted
app → say → data
ZyMix is heavily targeting the university market and is offering £200 to £400 a month to people who agree to be brand ambassadors on campuses.
asserted
who → target → campuses
Staff roles have also been advertised in the UK by ZyMix for Mandarin-speaking applicants.
asserted
roles → advertise → applicants
One advert on LinkedIn for the job of operations manager (Mandarin speaking) required “excellent written and verbal communication skills in both English and Mandarin (required for daily communication with the China team)”.
asserted
advert → require → team
Separately, a distinct company appeared to be recruiting on behalf of ZyMix on WeChat, the Chinese instant messaging service, saying: “The product, R&D, design and testing team is in Greater China, with branch-company bases covering: Taipei / Shenzhen / Guangzhou / Hangzhou / Chengdu / Zhengzhou.”
asserted
bases → appear → Zhengzhou
Ghaffur said that Flicknmix, the UK company that publishes the ZyMix app, “does not have any subsidiaries or branch offices in China.
asserted
that → say → China
Our aim is to create opportunities within the UK”.
asserted
aim → create → UK
A spokesperson for ZyMix described it as “British born”.
asserted
spokesperson → describe → it
The Aporia
