Family records two streams of activity on every monitored node — the programs that get launched and the DNS names the device looks up — and rolls them up into per-day summaries you can scrub from the Control Panel. On top of that raw data sits an alert engine that fires in real time the moment a policy kicks in, a daemon goes dark, or someone bumps a bedtime wall. This page covers what the Timeline and Summary tabs show, how the four alert kinds reach you, and what the optional weekly digest looks like.

Timeline

The Timeline tab on a device’s page is the raw event stream — one row per program launch, one row per DNS query, in chronological order. It’s the view you open when you want to answer “what did they actually do between 4pm and 6pm?” instead of looking at a rolled-up chart.

• Per-user picker. The drop-down at the top of the tab lists only the users on this device that have Monitor turned on. Pick the one you’re investigating; everyone else is hidden.
• Kind chips. Three chips — All, exec, dns — filter the stream by event kind. exec is a program launch (one row when the process starts); dns is a name lookup the device tried to resolve.
• Payload search. A search box matches against the program name or DNS qname. Useful for “did Steam ever run today?” or “did this device ever hit discord.com?”.
• Row format. Each row shows the local time of the event and the payload — the program path for exec, the queried hostname for dns. Times are rendered in the supervisor’s browser timezone, not the node’s, so the timeline reads naturally even when the node is somewhere else.

Raw events live on the node for 7 days. After that the per-event rows are dropped and only the per-day summary survives — so if you need to investigate something more than a week back, you’ll be looking at the rolled-up Summary tab, not the Timeline.

Summary

The Summary tab takes a single day’s worth of events and rolls them into the four numbers you actually want to see at a glance. It’s the right place to start when you don’t have a specific incident in mind — just “how did yesterday go?”.

• Per-day picker. A date control selects the day to summarise. It defaults to today (UTC), so the panel reflects the current day’s activity as it accumulates. Pick any past date to revisit rolled-up history.
• Top 10 apps. A horizontal bar chart ranking the ten programs that ran most frequently on the selected day, ordered by launch count. Hover a bar to see the exact count and full program path.
• Top 10 domains. A second horizontal bar chart, same shape, but ranking the ten hostnames the device queried most often. This is the closest thing to a “what sites did they visit?” view — DNS lookups are the most reliable signal we have without intercepting HTTPS.
• Late-night events. A single counter for the number of events (any kind) that landed between 22:00 and 07:00 UTC. If that number is anything other than zero on a school-night kid’s device, it’s usually worth a look.
• Screen-time gauge. When a daily budget is set in Policies, a gauge across the top of the panel shows minutes-used vs the configured cap. Red when over, amber when within ten minutes, green otherwise.

Alerts

The alert engine fires whenever the node observes a policy event or a liveness anomaly. There are four alert kinds and they reach supervisors through two channels.

Kinds

• block_attempt — a monitored user tried to resolve a hostname on a blocked category or custom list. The alert carries the qname, the matched category, and the user.
• bedtime — a monitored user tried to sign in inside their bedtime window, or an existing session crossed the boundary and was locked. Useful for confirming the boundary is actually being enforced.
• budget — a monitored user has hit their configured daily screen-time cap and their foreground session was suspended.
• daemon_offline — the Family agent on the node has stopped reporting heartbeats. See Heartbeat watchdog below.

Channels

• Push. Every alert is recorded as an in-product notification visible from the Control Panel’s bell icon. In v1 this is a log-only stub — alerts land in the notifications list but no external push provider is wired up yet. You can plug a real push channel (Pushover, ntfy, mobile push) in later without changing any of the per-alert logic.
• Email. Every alert is also delivered to the organisation owner’s email address. If the owner doesn’t have one configured, the first organisation admin is used as a fallback. Email delivery is Gmail-backed and is configured once per organisation in the Control Panel — once it’s set, every alert routes through it automatically.

Rate-limit

block_attempt is the noisy one — a single curious browser can resolve a blocked domain dozens of times a minute. To keep the inbox useful, block_attempt is capped at one alert per minute per monitored user. The block itself still happens every time; only the alert is collapsed. The other three kinds (bedtime, budget, daemon_offline) are inherently low-volume and aren’t rate-limited at the per-event level.

Weekly digest (Pro)

The weekly digest is a single email that summarises the past seven days of Family activity across every monitored user on every device in your organisation. It’s the right channel for “I don’t want a ping every time, but I do want to know how the week went.”

• When. Sundays at 22:00 UTC, every week. The schedule is UTC-only — it does not adapt to the organisation’s timezone, so pick the digest cadence with that in mind.
• What’s in it. Per monitored user: total foreground time over the week, top apps and top domains for the week, screen-time-vs- budget for each day, and the late-night event counts. Same numbers the Summary tab shows, but rolled across seven days instead of one.
• Subscribing. Open Family → Digest in the Control Panel, enter the email address that should receive the digest, and confirm. One email address per subscriber; multiple subscribers are supported.
• Unsubscribing. From the same Family → Digest page, remove the subscriber row. Effective immediately — the next Sunday at 22:00 UTC won’t send to that address.

The weekly digest is a Pro-tier capability — see Family overview for the full Free vs Pro matrix.

Heartbeat watchdog

Every enabled Family node sends a heartbeat to the Control Panel once a minute while the agent is running. The CP runs a watchdog that polls each node’s last-heartbeat timestamp on the same cadence.

If more than five minutes pass without a heartbeat from a node, the watchdog fires a daemon_offline alert through the standard push + email channels. This usually means the node is powered off, has lost network, or the agent has crashed.

The watchdog de-duplicates daemon_offline alerts to at most one per hour per node — a node that’s been off all weekend doesn’t flood the inbox; you’ll get one alert when it first goes dark and then nothing again until either the node comes back or an hour has passed and it’s still missing.

Where to next

• Family policies — how blocklists, bedtime windows, and daily budgets are authored, and which of them feed block_attempt, bedtime, and budget alerts.
• Family screen — live screen view setup and audit trail (Pro).
• Family hardening — boot-path lockdown that keeps a monitored user from disabling the agent (and silencing the daemon_offline alert with it).