UK student app uses servers linked to Chinese firm on US military blacklist
IN SHORTA new super app for UK students, ZyMix, is using servers linked to Tencent Holdings, a Chinese company on a US military blacklist. The app, which combines chat and payment features, initially stated its data was stored by Tencent but has since revised its privacy policy. Tencent denies being a military company.
Who's Involved
ZyMix
UK student 'super app' using servers linked to Tencent Holdings
Tencent Holdings
Chinese company on US military blacklist, providing auxiliary services
US Department of Defense
Maintains list of Chinese military companies
Tarique Ghaffur
Security consultant for ZyMix, declined to provide information
Fraser Sampson
Professor of security and national governance, skeptical of 'commercial confidentiality' claims
Sam Dunning
Director of UK-China Transparency NGO, questioning ZyMix's due diligence
↳ Why This Matters
The use of servers linked to a Chinese firm on a US military blacklist by a student-focused app raises concerns about data privacy, security, and potential geopolitical risks for UK users, particularly in the context of broader US-China technological tensions.
Key facts
- A new 'super app' for UK students, ZyMix, uses servers linked to Tencent Holdings.
- Tencent Holdings is on a US Department of Defense list of Chinese military companies.
- ZyMix's initial privacy policy stated Tencent stored user-generated content and messages.
- The app's privacy policy was updated to remove Tencent and state data is stored in the UK and EU.
A new messaging and payment 'super app' targeting British students, called ZyMix, has come under scrutiny for using servers linked to a Chinese company that is on a US military blacklist. ZyMix, which aims to combine chat, payments, and community features for 'gen Z', initially disclosed in its privacy policy that its data was stored by Tencent Holdings, a Chinese conglomerate.
Tencent Holdings was added to the US Department of Defense's (DoD) section 1260H list in January 2026, which identifies Chinese military companies. The DoD cited Tencent's alleged affiliation with the Chinese People's Liberation Army. This blacklist is part of a US effort to counter China's technological advancements that could bolster its military power.
Following inquiries, ZyMix updated its privacy policy. The revised policy states that user data is stored and processed primarily in the UK and EU, with auxiliary infrastructure providers in the EU receiving only encrypted messages and limited technical data. A spokesperson for ZyMix clarified that Tencent Cloud Europe BV is used for auxiliary services and performance testing, not for storing user data, and that the company is updating its privacy notice as it develops its services.
Tencent has stated that its inclusion on the DoD list is a mistake, asserting it is not a military company or supplier and that the listing has no impact on its business. The company plans to work with the DoD to address any misunderstandings.
The use of Chinese-owned infrastructure by UK entities, particularly in higher education, has become a point of concern. MI5 has previously warned British universities about cutting ties with Chinese research institutes suspected of channeling funding from Beijing's intelligence services.
ZyMix is actively recruiting brand ambassadors on UK university campuses and advertising for Mandarin-speaking roles, with one job description mentioning daily communication with a 'China team'. A separate recruitment notice on WeChat indicated that the product, R&D, design, and testing team is based in Greater China. ZyMix has stated that its UK-based publishing company, Flicknmix, has no subsidiaries in China and aims to create opportunities within the UK, describing the app as 'British born'.