An “super app” called ZyMix, designed specifically for British students, is under scrutiny for reportedly using servers owned by Tencent Holdings, a Chinese company that has been blacklisted by the United States for aiding the military development of the Chinese Communist Party. ZyMix claims to be a domestic British enterprise.
ZyMix is a newly launched social media super app in the UK, targeting Generation Z students, containing features such as real-time chatting, short videos, mobile payments, social functions, AI assistants, and mini-games. The app aims to replace the fragmented social tools that students currently use, like WhatsApp, Instagram, TikTok, all at once.
On Tuesday, October 13th, The Guardian reported that ZyMix’s initial privacy policy revealed that some user data and content were hosted on servers of Tencent’s German subsidiary, Tencent Frankfurt.
Due to Tencent being added to the US Department of Defense list of Chinese military-related enterprises in January 2026, concerns about data security and sensitive information held by companies with Chinese connections have been raised.
In a document required by law to be disclosed, ZyMix disclosed that Tencent Frankfurt stored user-generated content and messages. However, after being contacted by The Guardian, the privacy policy was revised, and content related to Tencent was removed.
A Tencent spokesperson stated that the company’s inclusion on the list was a “clear mistake,” claiming that Tencent is not a military enterprise or supplier.
The influence of China in the higher education sector in the UK has become a controversial issue. The UK Security Service (MI5) recently warned universities in the UK to sever ties with the China General Technology Research Institute (CGRI), accusing the organization of funnelling funds to Chinese intelligence agencies.
Following the update, ZyMix’s policy states that user data is primarily stored within the UK and the EU, with some service providers located in the US.
A company spokesperson clarified that their cooperation with Tencent Cloud Europe BV is limited to auxiliary services, and they do not store user data, emphasizing compliance with UK data protection regulations.
The new privacy policy invites users who wish to know the identity of suppliers to request information from the company.
However, following a request submitted by The Guardian, Tarique Ghaffur, self-proclaimed ZyMix security advisor and former Assistant Commissioner of the London Metropolitan Police, replied, “For reasons of commercial confidentiality, contractual obligations, and legal privilege, we’re unable to provide you with the requested information.”
Professor Fraser Sampson, a national security and governance expert in the UK, noted that ZyMix’s use of “commercial confidentiality” to evade scrutiny and their casual modification of the privacy policy are both unwise decisions.
He emphasized that when companies request personal data from users, they should anticipate questions regarding the storage location, purpose, and sharing of data—and they should be prepared to provide thorough answers.
An advertisement on Chinese social media platform WeChat reveals that ZyMix’s product, research, design, and testing teams are located in Greater China, with branches in Taipei, Shenzhen, Guangzhou, Hangzhou, Chengdu, and Zhengzhou.
ZyMix also has a job posting on LinkedIn specifically seeking an operations manager fluent in Mandarin, requiring “outstanding English and Mandarin written and oral communication skills (required for daily communication with the Chinese team).”
Flicknmix, ZyMix’s British distributing company, stated that they do not have any subsidiaries or branches in China. Their spokesperson claimed that the company is a “domestic British enterprise.”