Presence and Activity Indicator Spec Template

The most recently active device determines the user's presence status. If a user is active on their phone, their desktop shows them as Online even if the desktop is idle. When the user becomes active on desktop, the phone session transitions to a secondary role. Heartbeats from all devices are tracked independently, and the presence service resolves the composite status. Most implementations use a "most recent activity wins" algorithm with a 30-second sync window.

5-10 minutes for real-time collaboration tools (where stale presence is disruptive), 10-15 minutes for project management tools (where presence is informational), and 15-30 minutes for async-first tools. Start with 10 minutes and adjust based on your ghost session rate. If more than 15% of "Online" users are actually idle, tighten the threshold.

Status changes (online/away/offline) should propagate within 2-5 seconds. This is "near real-time" and uses WebSocket heartbeats. Cursor positions need true real-time (< 100ms) for a smooth experience. Activity feed events can be eventually consistent (up to 30 seconds delay). Match the update frequency to the use case. Not everything needs sub-second delivery.

At scale, you cannot broadcast every status change to every connected client. Use a pub/sub model where clients subscribe only to presence channels they care about (their current project, their team, users in their viewport). Use Redis or a dedicated presence service for status lookups. Batch status updates rather than sending individual status change events. Consider "presence aggregation" at the workspace level: "42 members online" instead of tracking each user.

Presence data reveals when users are working, how long they are active, and what they are looking at. In some jurisdictions, this may be considered employee monitoring. Be transparent: tell users what activity signals you track in your privacy documentation. Offer controls: invisible mode, DND, and the ability to disable last-seen timestamps. Do not expose granular activity data (e.g., time-on-page per user) to anyone other than the user themselves without explicit organizational policies. ---