ZyMix launched last week as the UK's first "super app" for students, bundling messaging, payments, and community features into a single platform targeting university campuses. Its privacy policy at launch disclosed that user-generated content and messages were stored by Tencent (Frankfurt), a subsidiary of the Shenzhen-based conglomerate added to the US Department of Defense's Section 1260H list of Chinese military companies in January 2026 for alleged indirect affiliation with the People's Liberation Army. After the Guardian contacted ZyMix, the company rewrote its privacy policy entirely. References to Tencent vanished. The new version states data is stored "primarily in the United Kingdom and the EU" and describes unnamed "auxiliary infrastructure providers" that receive "only encrypted user messages and limited technical data." A spokesperson called Tencent a provider used "solely for performance testing" rather than for storing user data — a characterisation that contradicts the original policy's plain language. When asked to identify its infrastructure providers, the company declined. Tarique Ghaffur, a former Metropolitan Police assistant commissioner now serving as ZyMix's security consultant, cited "commercial confidentiality, contractual obligations and legal privileges." Fraser Sampson, formerly the UK's biometrics and surveillance camera commissioner, called the confidentiality argument a way to "duck basic policy questions," adding that "amending policy on the fly is never reassuring." The personnel trail points to deep mainland Chinese operational roots despite the company's self-description as "British born." A LinkedIn posting for an operations manager required Mandarin for "daily communication with the China team." A separate recruitment drive on WeChat — the Chinese messaging platform — described ZyMix's product, R&D, design, and testing teams as based across Taipei, Shenzhen, Guangzhou, Hangzhou, Chengdu, and Zhengzhou. Ghaffur insisted the UK parent company, Flicknmix, "does not have any subsidiaries or branch offices in China." The Tencent relationship sits within a broader pattern of contested Chinese technology presence in UK higher education. MI5 recently warned universities to sever ties with the China General Technology Research Institute, alleging it secretly funnelled Beijing intelligence funding to UK-linked academics to enhance espionage capabilities. Tencent itself disputes its military designation, calling it "clearly a mistake" and noting the listing carries no automatic sanctions or business impact. ZyMix is aggressively courting the student market, offering £200 to £400 monthly to campus brand ambassadors. The combination of financial incentives, a payments stack, messaging infrastructure, and university-age user data creates a particularly sensitive data collection profile — precisely the kind of target that intelligence services worry about. Sam Dunning of UK-China Transparency said there are "serious questions about whether ZyMix have taken due care before launching this product." The core problem is not that ZyMix used Tencent infrastructure — many companies do. It is the sequence: launch with a Tencent disclosure, get questioned by journalists, rewrite the privacy policy to obscure the relationship, refuse to identify providers when asked, and simultaneously recruit a China-based workforce while branding the product as British. Each step individually might be benign. The pattern is not.
