fix(legal): declare report, block and hide in the app's data safety #46

wtclaude · 2026-10-30T11:03:16-05:00

wtclaude commented

2026-10-30 11:03:16 -05:00

What & why

The app now sends reports, blocks and hides (USER_SAFETY.md step 4, Android-app#64). The M8 plan said this work would add its own data-safety rows, and until now nothing in collection.mjs covered them.

New app row, app-safety: "What you report, block or hide"

What leaves the phone, read from SafetyApi.kt, SafetyDto.kt and RustApi.kt:
- a report sends the line, the reason picked and an optional note of up to 500 characters;
- Hide for me and Block player send the line;
- unblocking sends the block's id;
- staff's Hide for everyone and Show to everyone again send the line.
No request names the blocked person: the deployment works out who wrote the line. So this is not declared as a User ID.
Play mapping: App activity → Other user-generated content (the note) and App activity → Other actions (reporting, blocking and hiding). Collected, not shared, required.
Purposes: App functionality; Fraud prevention, security, and compliance; Personalization.

PLAY_DATA_SAFETY.md (regenerated)

Other actions moves from "not collected" to collected.
Other user-generated content gains the two extra purposes.

Deployment row deploy-content

It now says a report keeps a copy of what it reported.
It now says blocks and hides are kept on the account and deleted with it, because user_blocks and user_hidden_items cascade.

Flagged, not changed: the /delete-account/ "goes" list copies the website's own WHAT_GOES words, and those don't mention blocks and hides, even though both are deleted with the account. I left both lists as they are. Adding the line belongs in a website PR first, if you want it.

Console: once this merges, the Data Safety form needs Other actions ticked, and the purposes on Other user-generated content updated to match the table.

How it was tested

npm test: 60/60 pass.
These checks pass: check:datasafety, check:terms, npm run build, check:terms:built and check:links.
I did not run the full npm run verify (astro check, served headers, a11y, csp and the facts checks). This change touches only the data file and the generated markdown.

Checklist

I have read CONTRIBUTING.md.
npm run verify passes locally (all eleven checks and both test suites). (Subset only, see above.)
No fact is stated in prose — versions and platform facts come from src/data/platform.json.
PLAN.md still describes what this repository does; a decision it records is either
unchanged or amended here, with the reasoning.
My commits are reasonably scoped, with Conventional Commit messages.

AI-assisted contributions (required)

No AI tools were used to produce this contribution.
AI tools were used. Tool(s): Claude Code (Claude Opus 5.5). I have reviewed and understand
every change, and take responsibility for it. AI-authored commits are
marked with a Co-Authored-By / Assisted-By trailer.

License

I agree that my contribution is licensed under this project's license
(GNU GPL v3.0 or later), and I have the right to contribute it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

## What & why The app now sends reports, blocks and hides (USER_SAFETY.md step 4, Android-app#64). The M8 plan said this work would add its own data-safety rows, and until now nothing in `collection.mjs` covered them. **New app row, `app-safety`: "What you report, block or hide"** - What leaves the phone, read from `SafetyApi.kt`, `SafetyDto.kt` and `RustApi.kt`: - a report sends the line, the reason picked and an optional note of up to 500 characters; - Hide for me and Block player send the line; - unblocking sends the block's id; - staff's Hide for everyone and Show to everyone again send the line. - No request names the blocked person: the deployment works out who wrote the line. So this is not declared as a User ID. - Play mapping: **App activity → Other user-generated content** (the note) and **App activity → Other actions** (reporting, blocking and hiding). Collected, not shared, required. - Purposes: App functionality; Fraud prevention, security, and compliance; Personalization. **`PLAY_DATA_SAFETY.md` (regenerated)** - *Other actions* moves from "not collected" to collected. - *Other user-generated content* gains the two extra purposes. **Deployment row `deploy-content`** - It now says a report keeps a copy of what it reported. - It now says blocks and hides are kept on the account and deleted with it, because `user_blocks` and `user_hidden_items` cascade. **Flagged, not changed:** the `/delete-account/` "goes" list copies the website's own `WHAT_GOES` words, and those don't mention blocks and hides, even though both are deleted with the account. I left both lists as they are. Adding the line belongs in a website PR first, if you want it. **Console:** once this merges, the Data Safety form needs *Other actions* ticked, and the purposes on *Other user-generated content* updated to match the table. ## How it was tested - `npm test`: 60/60 pass. - These checks pass: `check:datasafety`, `check:terms`, `npm run build`, `check:terms:built` and `check:links`. - I did not run the full `npm run verify` (astro check, served headers, a11y, csp and the facts checks). This change touches only the data file and the generated markdown. ## Checklist - [ ] I have read [CONTRIBUTING.md](CONTRIBUTING.md). - [ ] `npm run verify` passes locally (all eleven checks and both test suites). *(Subset only, see above.)* - [x] No fact is stated in prose — versions and platform facts come from `src/data/platform.json`. - [x] `PLAN.md` still describes what this repository does; a decision it records is either unchanged or amended here, with the reasoning. - [x] My commits are reasonably scoped, with Conventional Commit messages. ## AI-assisted contributions (required) - [ ] No AI tools were used to produce this contribution. - [x] AI tools were used. Tool(s): `Claude Code (Claude Opus 5.5)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a `Co-Authored-By` / `Assisted-By` trailer. ## License - [x] I agree that my contribution is licensed under this project's license (**GNU GPL v3.0 or later**), and I have the right to contribute it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-30 11:03:17 -05:00

fix(legal): declare report, block and hide in the app's data safety

PR checks / checks (pull_request) Failing after 3m21s

Details

dff4232491

The app now sends reports, blocks and hides (USER_SAFETY.md step 4,
Android-app#64). A new app row, app-safety, declares them: App activity ->
Other user-generated content (the report's note) and Other actions (the
report, block and hide themselves), collected, not shared, required. Other
actions moves from "not collected" to collected in PLAY_DATA_SAFETY.md.

The deployment row for posted content now says a report keeps a copy of
what it reported, and that blocks and hides are kept on the account and
deleted with it (user_blocks and user_hidden_items cascade).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

whitlocktech merged commit c1b38081f5 into main

2026-10-30 11:05:07 -05:00

whitlocktech referenced this issue from a commit

2026-10-30 11:05:07 -05:00

Merge pull request 'fix(legal): declare report, block and hide in the app's data safety' (#46) from fix/play-data-safety-user-safety into main

whitlocktech deleted branch fix/play-data-safety-user-safety

2026-10-30 11:05:08 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/runicgateway.com#46