diff --git a/PLAY_DATA_SAFETY.md b/PLAY_DATA_SAFETY.md
index 6b0abfc..5bd18e8 100644
--- a/PLAY_DATA_SAFETY.md
+++ b/PLAY_DATA_SAFETY.md
@@ -38,7 +38,8 @@ Play still counts what the app sends to that server as **collected**: the data l
 | Messages | Other in-app messages | Yes | No | Yes | App functionality | Your name, email address and message, if you use Contact; What you post and send from the app |
 | App activity | App interactions | Yes | No | Yes | App functionality; Personalization | Which notifications you have read, and which you want |
 | App activity | In-app search history | Yes | No | Yes | App functionality | What you search for |
-| App activity | Other user-generated content | Yes | No | Yes | App functionality | What you post and send from the app |
+| App activity | Other user-generated content | Yes | No | Yes | App functionality; Fraud prevention, security, and compliance; Personalization | What you post and send from the app; What you report, block or hide |
+| App activity | Other actions | Yes | No | Yes | App functionality; Fraud prevention, security, and compliance; Personalization | What you report, block or hide |
 | App info and performance | Diagnostics | Yes | No | Yes | App functionality; Fraud prevention, security, and compliance | The app’s version and your Android version |
 | Device or other IDs | Device or other IDs | Yes | No | Yes | App functionality; Fraud prevention, security, and compliance; Account management | The trusted-device token and the device’s name, if you asked for one; Push registration, if you turn notifications on |
 
@@ -56,7 +57,7 @@ The form lists every type, so every one is answered. Vocabulary read from Play C
 - **Files and docs:** none collected.
 - **Calendar:** none collected.
 - **Contacts:** none collected.
-- **App activity:** Installed apps, Other actions: not collected.
+- **App activity:** Installed apps: not collected.
 - **Web browsing:** none collected.
 - **App info and performance:** Crash logs, Other app performance data: not collected.
 
@@ -169,6 +170,19 @@ Most of the app is reading. What it sends is what you write, and most of that is
 - **Retention:** Held by the deployment, under its operator’s policy
 - **Read from:** `data/api/AdminApi.kt`
 
+### What you report, block or hide
+
+**App activity → Other user-generated content; App activity → Other actions.** Collected, not shared, required.
+
+Purposes: App functionality; Fraud prevention, security, and compliance; Personalization.
+
+Long-pressing a chat line offers Report, Hide for me and Block player. A report sends which line it is, the reason you picked and, if you wrote one, a note of up to 500 characters, so the deployment’s staff can review it. Hide for me and Block player send which line it is; the deployment works out who wrote it and keeps the hide or the block on your account, so it applies on the website and on every device. Your list of blocks, and unblocking someone, come from and go to the same place. For staff, Hide for everyone and Show to everyone again send the line too. Nothing is sent until you choose one.
+
+- **Why that answer:** The report’s note is text the user writes, and reporting, blocking and hiding are actions the app sends to the deployment, which keeps them. Reports exist so staff can act on abuse; blocks and hides change what this one reader is shown.
+- **Retention:** Held by the deployment, under its operator’s policy
+- **In detail:** A block or a hide lasts until you remove it or delete the account, which deletes them. A report stays as a moderation record, with a copy of what the line said, until the operator removes it.
+- **Read from:** `data/api/SafetyApi.kt, data/api/dto/SafetyDto.kt, data/api/RustApi.kt`
+
 ### Which notifications you have read, and which you want
 
 **App activity → App interactions.** Collected, not shared, required.
diff --git a/src/data/collection.mjs b/src/data/collection.mjs
index 7f3066e..3640a00 100644
--- a/src/data/collection.mjs
+++ b/src/data/collection.mjs
@@ -499,6 +499,51 @@ export const collected = [
         'We have no copy, no access and no way to obtain one.',
     },
   },
+  /*
+   * Report, block and hide (USER_SAFETY.md §4.3), on Android-app#64 rather than the edge
+   * commit the section header names. Read out of `data/api/SafetyApi.kt` and
+   * `data/api/dto/SafetyDto.kt`: a report sends the item's type and id, a reason and an
+   * optional note; a block and a hide send the item's type and id; unblocking sends the
+   * block's id. No request names the person being blocked — the deployment works out who
+   * wrote the line — so none of it is a User ID.
+   */
+  {
+    id: 'app-safety',
+    scope: 'app',
+    title: 'What you report, block or hide',
+    body:
+      'Long-pressing a chat line offers Report, Hide for me and Block player. A report ' +
+      'sends which line it is, the reason you picked and, if you wrote one, a note of up to ' +
+      '500 characters, so the deployment’s staff can review it. Hide for me and Block ' +
+      'player send which line it is; the deployment works out who wrote it and keeps the ' +
+      'hide or the block on your account, so it applies on the website and on every device. ' +
+      'Your list of blocks, and unblocking someone, come from and go to the same place. For ' +
+      'staff, Hide for everyone and Show to everyone again send the line too. Nothing is ' +
+      'sent until you choose one.',
+    retention: {
+      summary: 'Held by the deployment, under its operator’s policy',
+      detail:
+        'A block or a hide lasts until you remove it or delete the account, which deletes ' +
+        'them. A report stays as a moderation record, with a copy of what the line said, ' +
+        'until the operator removes it.',
+    },
+    source: 'data/api/SafetyApi.kt, data/api/dto/SafetyDto.kt, data/api/RustApi.kt',
+    play: {
+      types: [
+        { category: 'App activity', type: 'Other user-generated content' },
+        { category: 'App activity', type: 'Other actions' },
+      ],
+      collected: true,
+      shared: false,
+      required: true,
+      purposes: ['App functionality', 'Fraud prevention, security, and compliance', 'Personalization'],
+      answer: 'Collected, not shared, required.',
+      because:
+        'The report’s note is text the user writes, and reporting, blocking and hiding are ' +
+        'actions the app sends to the deployment, which keeps them. Reports exist so staff ' +
+        'can act on abuse; blocks and hides change what this one reader is shown.',
+    },
+  },
   {
     id: 'app-interactions',
     scope: 'app',
@@ -746,7 +791,10 @@ export const collected = [
     title: 'Everything posted on the site',
     body:
       'Forum threads and replies, uploads, wiki revisions, moderation actions, warnings, ' +
-      'reports and appeals — with the account that made each one. Where the operator has ' +
+      'reports and appeals — with the account that made each one. A report keeps a copy ' +
+      'of what the reported post or chat line said, so staff read what was reported even ' +
+      'after it is edited or pruned. Each member’s blocks and the items they hid for ' +
+      'themselves are kept against their account, and deleted with it. Where the operator has ' +
       'connected Discord, some of that crosses into Discord and is then also subject to ' +
       'Discord’s own terms.',
     retention: {
@@ -755,7 +803,9 @@ export const collected = [
         'Soft-deleted forum uploads and Team activity have retention windows an admin ' +
         'sets; most other content is kept until somebody removes it.',
     },
-    source: 'website server/db/schema.sql — team_forum_*, mod_actions, content_reports',
+    source:
+      'website server/db/schema.sql — team_forum_*, mod_actions, content_reports, ' +
+      'user_blocks, user_hidden_items',
   },
   {
     id: 'deploy-engagement',