# Desktop app and devices (https://docs.akollo.com/en/product-guide/desktop-app)



The Akollo desktop app runs on the employee's computer. It follows the organisation's recording policy: it records the foreground application, activity and idle time, and screenshots when they are enabled, and sends them to Akollo. It sits in the system tray and has no other window.

An optional browser extension for Chrome and Edge tells the desktop app which tab is in front. It talks only to the desktop app on the same computer, never to the server.

## How the data flows [#how-the-data-flows]

<Mermaid
  title="From the device to your day view"
  chart="`flowchart LR
X[Browser extension] -.->|Front tab, same computer only| A
P[Recording policy] --> A[Desktop app measures activity]
A --> B[Sends data to Akollo]
B --> C[Time credited to the selected task]
C --> D[My day and day view]
C --> E[Time reports]`"
/>

The task that time is credited to is the one selected for the device on **My tasks** (see [Time and tasks](/en/product-guide/time)).

## Signing in the desktop app [#signing-in-the-desktop-app]

When the desktop app asks you to sign in, it opens the **Desktop sign-in** page in your browser. Approve the request there and return to the app. A sign-in request is valid for 10 minutes and can also be declined. Your role must allow enrolling a device, and a support session cannot approve a sign-in.

<Steps>
  <Step>
    ### Start the sign-in from the desktop app [#start-the-sign-in-from-the-desktop-app]

    Open the desktop app from the system tray and start signing in. Your browser opens the **Desktop sign-in** page.
  </Step>

  <Step>
    ### Check the request [#check-the-request]

    The page shows the account, the organisation and the application. Approve only if you started this sign-in from the desktop app on this computer just now.
  </Step>

  <Step>
    ### Approve and return [#approve-and-return]

    Select **Approve and return to the agent**. The desktop app finishes signing in, and you can close the browser tab. To decline, select **Cancel sign-in**.
  </Step>
</Steps>

<Callout type="warn" title="Warning">
  If the request is older than 10 minutes, the page shows that there is no pending sign-in. Start again from the desktop app.
</Callout>

## Devices [#devices]

**Settings → Devices** lists desktop apps: your own, or every device in the organisation for administrators. For each device it shows the employee, the app version, when it was enrolled, when it was last seen and its status (for example signed in, signed out or revoked). A device can be revoked; a revoked device stops sending data.

<Screenshot src="/screens/en/settings-devices.webp" alt="Devices page with a table of enrolled desktop agents, their employee, agent version, enrolment date, last seen time, status and the Revoke action" caption="Devices: every enrolled desktop app with its status and actions." />

<Steps>
  <Step>
    ### Open the device list [#open-the-device-list]

    Choose **Settings → Devices**.
  </Step>

  <Step>
    ### Revoke the device [#revoke-the-device]

    Find the device in the list and select **Revoke**.
  </Step>

  <Step>
    ### Confirm [#confirm]

    Confirm with **Revoke device**. The device is signed out and can never sign in again. The employee can enroll the computer again as a new device.
  </Step>
</Steps>

<Callout type="info" title="Note">
  Revocation reaches a device when it connects. A revoked or signed-out desktop app is refused the next time it contacts the server. While it is offline it cannot be told; anything it records meanwhile is refused when it reconnects.
</Callout>

## Device health [#device-health]

**Device health** (`/tracking/health`) is for people who operate the recording service. Each device has a status: healthy, needs attention, silent, long silent or revoked. The reasons are shown, for example an out-of-date policy, missing events, an upload backlog, a missing monitor or browser extension, or a clock offset. A device's page shows its last heartbeat, version, platform, policy revision, sync gap, disk and monitors. The page also shows the state of the service itself (application, image analysis, media storage and background queues) and the thresholds it uses.

People with the operate permission can revoke a device or resend failed background jobs, each with a reason.

<Screenshot src="/screens/en/device-health.webp" alt="Device health with status cards for the application server, image analysis, media volume and captures awaiting a decision, a worker queue table and device cards filtered by status" caption="Device health: the state of the service, its queues and each device." />

<Callout type="info" title="Note">
  Silence, a gap or a missing signal describes a device or a connection. None of it says that the employee was idle, absent or unproductive.
</Callout>

## Recording policy [#recording-policy]

Administrators (organisation owner or administrator with the workforce-management permission) set the recording policy under **Settings → Workforce & recording**. Each change publishes a new revision with a start date and, optionally, an end date; the revision history is kept.

| Setting                           | What it controls                                                                                                                                                                                                                                           |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Schedule**                      | The time zone, working days and start and end time, and whether a regular, holiday or overtime schedule applies.                                                                                                                                           |
| **Idle**                          | After how many seconds without input time counts as idle, whether the employee may pause recording, and for how many minutes at most.                                                                                                                      |
| **Categories**                    | Rules that mark an application or site as productive, neutral, unproductive or unclassified, with a priority and whether a task must be selected. Rules can be set for the organisation, a department or a team, with a fallback for unknown applications. |
| **Screenshots** and **Retention** | See [Screen evidence and privacy](/en/product-guide/screen-evidence).                                                                                                                                                                                      |

## FAQ [#faq]

<Accordions type="single">
  <Accordion title="Does the browser extension send data to Akollo?">
    No. It only tells the desktop app on the same computer which tab is in front. It never talks to the server.
  </Accordion>

  <Accordion title="How long is a sign-in request valid?">
    10 minutes. After that, start the sign-in again from the desktop app.
  </Accordion>

  <Accordion title="What happens to a laptop that is offline when I revoke it?">
    It cannot be told while it is offline. The next time it contacts the server it is refused, and anything it recorded in the meantime is refused too.
  </Accordion>

  <Accordion title="Can a revoked computer be used again?">
    The revoked device can never sign in again. The employee can enroll the same computer again as a new device.
  </Accordion>

  <Accordion title="Does a silent device mean the employee was not working?">
    No. Device health describes devices and connections only. A silent device says nothing about whether the employee was idle, absent or unproductive.
  </Accordion>
</Accordions>