Collecto documentation

Overview

Collecto is a self-hosted mailroom and package-reception system written in PHP and MySQL. Front-desk staff log incoming parcels in seconds, recipients are told by email (and WhatsApp if you like), and every pickup is recorded with a code or QR scan, a signature and a full chain of custody. It also handles outgoing mail, courier pickups and reports. It suits offices, coworking spaces, apartment buildings, universities, hotels and hospitals.

• Fast intake: scan or type the tracking number, pick the recipient, done. The courier is detected from the number, a shelf is suggested, and a photo and AI label reading are optional.
• Notifications: arrival emails grouped per person, reminders, collection receipts and an end-of-day summary for the team.
• Pickup: 6-digit pickup code or QR, ID check for delegates, one signature for many parcels, PDF receipt.
• Recipient portal: no passwords. Recipients see their parcels and pickup code, add delegates, ask for forwarding, set away periods and request outgoing mail.
• Outgoing mail: requests, courier pickup sheet signed by the driver, delivery tracking and cost centres.
• Admin: four roles, several sites, reports with CSV and PDF, audit log, backups, light and dark mode, English and Spanish.

Server requirements

Collecto runs on ordinary shared hosting. There is no build step and nothing to install with Composer or npm.

Installation

1. Create an empty MySQL database and a user with full rights on it (most hosts do this in cPanel → MySQL Databases).
2. Upload the contents of the collecto folder to your server, either to the web root or to a subfolder such as /mailroom.
3. Make sure config/, storage/ and uploads/ are writable by the web server (755 or 775 usually works).
4. Open the site in your browser. You are sent to /install/. The installer checks the server, then asks for the database details, your organisation name and the first administrator account.
5. Tick Add sample data if you want to explore with realistic demo data first. You can remove it later from System → Clean up data, or reinstall.
6. Finish, sign in and follow the setup checklist on the dashboard.

Running it on your computer

Install XAMPP (Windows, macOS, Linux), MAMP or Laragon. Copy the folder to htdocs/collecto, start Apache and MySQL, create a database in phpMyAdmin and open http://localhost/collecto. The installer does the rest. The camera works on localhost without https.

Manual installation

If the installer cannot write config/config.php:

1. Import install/sql/schema.sql into your database with phpMyAdmin.
2. Copy config/config.sample.php to config/config.php and fill in the database details and APP_URL (the full address, no trailing slash).
3. Open /install/ again. It sees the configuration and only asks for the administrator account.

Nginx: route everything that is not a real file to index.php, and block direct access to config, core, storage and install/sql:

location / { try_files $uri $uri/ /index.php?$query_string; }
location ~ ^/(config|core|storage|install/sql)/ { deny all; }
location ~ ^/uploads/.*\.php$ { deny all; }

Scheduled tasks (cron)

Notifications, reminders and backups run in the background. Add one cron job that runs every minute. The exact line, with your own secret key, is shown in System → Scheduled tasks:

* * * * * php /path/to/collecto/cron.php >/dev/null 2>&1
# or, if your host only allows web cron:
* * * * * wget -q -O - "https://your-site/cron.php?key=YOUR_KEY" >/dev/null

First-run setup

The dashboard shows a checklist until everything is done:

1. Sites: your reception or mailroom. Add more if you have several buildings.
2. Storage locations: shelves, racks, lockers or a cold room. Give them a capacity and the parcel types they suit; intake then suggests a shelf.
3. Recipients: add people one by one or import a CSV. Recipient groups can be departments, floors, units or teams; choose the word in Settings → General.
4. Email: enter your SMTP details in Settings → Email & WhatsApp and send a test.
5. Staff: invite colleagues in Users and choose their role.

Interface basics

• The sidebar groups Mailroom (Receive, Pickup, Packages, Shelves, Outgoing, Requests, Recipients), Insights (Reports) and Administration.
• Every list has search, filters, sorting and summary cards. On phones, tables turn into cards.
• Every action that changes or deletes data asks for confirmation first. Records with linked data (for example a recipient with packages) cannot be deleted; you are told why and offered a safe alternative.
• Light and dark mode follow the device and can be switched from the top bar.
• Staff can install Collecto like an app on a phone or tablet (Add to Home Screen).

Receiving packages

Open Receive. The form has five short steps and works with a hand scanner and the keyboard alone:

1. Tracking number: scan it with a USB or Bluetooth scanner, the phone camera (Scan) or type it. The courier is recognised from the number format, and you are warned if the number was already logged.
2. Who is it for: type 3–4 letters of the name and press Enter. Not in the directory? Add them on the spot.
3. What is it: letter, small, medium or large parcel, or oversized. Mark it urgent, fragile or perishable.
4. Where: shelf and courier. A shelf is suggested from its capacity and the parcel type.
5. Extras: a photo, the number of pieces and a note (quick chips such as "Box damaged").

Press Enter or Log package. The site, shelf, type and courier stay selected for the next parcel, and today's list on the right shows what you logged. Each package gets a reference such as P-2026-001234 and a printable label (single label or an A4 sheet of 3 × 8).

Read label (AI, optional): photograph the shipping label and Collecto fills in the tracking number and suggests the recipient and parcel type. On a laptop the webcam opens; on a phone, the camera. Staff always choose the person before saving.

Recipients & groups

Recipients are the people who receive mail. They never get a password; they use the portal.

• Profile: waiting and collected packages, delegates, notification preferences and a timeline of everything that happened.
• Delegates: people allowed to collect for them, optionally until a date.
• Portal link: Email portal link sends a private link; Copy portal link shows one to share in person or by chat (useful for people without email). Links last 120 days.
• WhatsApp button: opens WhatsApp with a ready message and the pickup code (see WhatsApp).
• Status: mark people who left as Left; their history is kept but they cannot receive new parcels.

CSV import

Recipients → Import accepts CSV files separated by commas, semicolons or tabs. Columns are matched automatically and can be changed before importing: name (required), email, phone, department (the group), ref_no (ID or unit number), location (desk, room or unit) and notes. Missing groups are created. A preview shows every row before anything is saved.

Notifications

• Arrival: parcels for the same person within the grouping window go in one email with the list, the pickup code, a QR code, the first photo and a portal button.
• Reminders: sent at the interval you choose while a parcel waits.
• Collected: a receipt saying who collected and when (can be turned off).
• End-of-day summary: to the addresses you enter, after the hour you choose, optionally with an AI insight.
• Overdue alert: to an escalation list when parcels near the hold limit.

Settings → Notifications has a message editor for every email in every language, with placeholders ({name}, {count}, {packages}, {pickup_code}, {site}, {portal_link}, {return_date}, {collected_by}, {org}), a preview and, if AI is on, Write with AI to rewrite or translate. Each recipient gets messages in their own language.

Staff can also send a one-off message about a package (for example "arrived damaged") from the package page, by email or WhatsApp, optionally drafted by AI.

Pickup & custody

Open Pickup and identify the person in one of three ways:

• Pickup code: the 6-digit code from their email or portal. One code covers all their parcels.
• QR: scan the QR code from their email or phone.
• Staff confirmed: search by name and give a reason (known to staff, ID checked, lost their code).

All waiting parcels appear, already ticked. Choose who is collecting (the person, or a delegate with an ID check), capture one signature for all of them and confirm. A PDF receipt can be printed or emailed. People who checked in at the kiosk appear at the top as At the counter now.

Every package has a chain of custody: received, notified, moved between shelves, put on hold, reminded, collected or returned, each with the staff member and the time. History on the package page downloads it as a PDF.

Self-service kiosk

Open /kiosk on a tablet at the counter (linked from the Pickup page). Recipients enter their pickup code or scan their QR; the desk sees them under At the counter now and brings the parcels. After 15 wrong codes in 15 minutes the kiosk pauses, so codes cannot be guessed.

Shelves & storage

Shelves shows every storage location with what is on it, how full it is, urgent items and the oldest parcel, plus Recent movements onto and off shelves. Move one parcel from its page, or many at once from the package list.

Returns & disposal

Parcels are held for the number of days in Settings → General (default 14). Parcels close to the limit appear on the dashboard and in the bell, and the escalation list is emailed. On the package page choose Return or dispose and give a reason; the parcel leaves the waiting list and the reason is kept. A parcel logged by mistake can be deleted while it is still waiting.

Outgoing mail

• Send something: sender (from the directory or typed), full address with a country list, service (standard, express, next day, same day, international), pieces, weight, cost, cost centre, reference and a photo.
• Requests: recipients can ask from their portal; staff accept or decline.
• Courier pickup: tick everything the driver takes, the driver signs once, and a pickup sheet (PDF) is saved.
• Tracking: each item has a timeline (requested, waiting, sent, delivered or returned). The sender is emailed on delivery or return.
• Costs: Reports shows the cost per cost centre, with CSV export.

Recipient portal

Recipients open the portal from the button in any email, or ask for a fresh link at /p/link (at most 3 links an hour per address). There are no passwords. In the portal they can:

• See waiting parcels, the pickup code and QR, and recent pickups and sends.
• Say when they will collect, or ask to forward a parcel to another site.
• Add or remove people who may collect for them.
• Set an away period; parcels are kept until they return.
• Ask the mailroom to send a parcel or letter.
• Choose email or WhatsApp, and their language.

Requests

Requests collects what recipients asked for: forward requests (move or decline), people coming to collect, who is away, and send requests (handled under Outgoing).

Reports

Pick a period: this month, last month, the last 7, 30 or 90 days, this year or custom dates. You see received and collected counts, average and median time to collect, the share collected within 24 hours, packages per day and per hour, breakdowns by courier, group and type, staff activity, packages not collected and outgoing cost per cost centre. Tables export to CSV and the whole page to a branded PDF. With AI on, Ask a question answers things like "How many parcels did Finance get last month, and how fast were they collected?"

Notification bell

The bell shows what needs attention now: people at the counter, requests to review, urgent or perishable parcels, parcels due for return, shelves nearly full, outgoing items waiting for a courier and failed messages (managers and admins). The badge counts what you have not opened yet.

Email (SMTP)

In Settings → Email & WhatsApp, turn on email and enter your SMTP host, port (587 for STARTTLS, 465 for SSL), username, password and sender address, then use Send a test email. Use your host's mail server, Google Workspace, Microsoft 365 or a service such as Brevo, Mailgun or Amazon SES. Failed emails are retried and listed in System → Email log.

WhatsApp

Choose how to use WhatsApp in Settings → Email & WhatsApp:

For Automatic: in Meta Business Manager create a WhatsApp app, note the phone number ID and a permanent access token, and create three message templates with three variables each (the settings page previews the suggested text): arrival (name, reference, pickup code), reminder (name, days, pickup code) and collected (name, reference, time). Enter the template names and their language, then send a test. Set the default country code so local numbers such as 07700 900123 work.

AI features

AI is optional and off by default. In Settings → AI choose OpenAI, Google Gemini or any OpenAI-compatible API, paste your own API key and turn on the features you want:

Nothing is sent until staff click an AI button (or the summary is due), and every use is recorded in the audit log. The default models are fast and cheap (for example gpt-4o-mini or gemini-flash-lite-latest); label reading needs a model that reads images.

Settings

Each user can turn on two-factor sign-in with an authenticator app in My account.

Sites, couriers & groups

• Sites: buildings or desks, each with its own storage. Staff choose the site at intake.
• Couriers: common couriers are added at install with tracking-number patterns and tracking links; add your own.
• Recipient groups: departments, floors, buildings, units, teams or houses.

Roles & permissions

Security & privacy

• Passwords hashed with bcrypt, login throttling with CAPTCHA, and optional two-factor sign-in.
• Security tokens on every form, prepared statements for every query, output escaped everywhere.
• Uploads are checked by their content, and the uploads folder cannot run scripts.
• Portal links are long random tokens that expire; the kiosk and portal sign-in are rate-limited.
• Audit log of changes, sign-ins and AI use; personal-data retention, and download or erase per person.

System, backups & clean-up

• Health: PHP, extensions, folders, database and cron status, with a copyable system report for support.
• Backups: one-click database backup (optionally with uploads), daily backups by cron, download and restore.
• Scheduled tasks: the cron line, the last run of each task and a Run now button.
• Email log and Logs: sent and failed emails, and PHP errors.
• Clean up data: remove finished packages, people who left, finished outgoing items or message logs older than a number of months. Make a backup first.
• Maintenance mode: show a notice to everyone but admins while you work on the site.

Languages & customization

English and Spanish are included. To add a language, copy core/lang/es.php to, for example, fr.php, change _name and translate the right-hand values; it then appears in Settings → General. Missing entries fall back to English. The logo and colours are in Settings → Design; the stylesheets are in assets/css.

Demo mode

Add define('DEMO_MODE', true); to config/config.php for a public demo: one-click sign-in for each role, realistic sample data rebuilt every hour, email and WhatsApp simulated (logged but never sent), AI answering with samples, and the settings that would break the demo locked. Never turn it on for real use.

FAQ & troubleshooting

Blank page or error 500

Check storage/error.log and your host's PHP error log. The cause is usually a PHP version below 8.0 or a missing extension; the installer's check lists both.

Pages other than the dashboard show "Not found"

mod_rewrite is off or .htaccess files are ignored (set AllowOverride All). On Nginx use the rules in manual installation.

Photos will not save

Make uploads/ writable and check upload_max_filesize and post_max_size (8 MB or more).

Emails are not sent

Use Send a test email; it shows the error. Check the port and encryption (587/STARTTLS or 465/SSL) and that cron runs. Look in System → Email log.

Reminders and the daily summary never arrive

Cron is not running. System → Scheduled tasks shows the last run of each task.

The camera does not open

Browsers only allow the camera on https:// or localhost, and the user must allow it. Upload a file instead always works.

A recipient did not get the email

The package page lists every message with its status and error. Check the address, their notification preference and the email log.

Can I run it without internet?

Yes, on a local network. Only email, WhatsApp and AI need an outside connection.

"Already installed" on the installer

Delete install/install.lock and config/config.php only if you really want to reinstall.

Changelog

1.0.0 — first release

Intake with scanner, courier detection and shelf suggestion · grouped notifications, reminders and daily summary · pickup with codes, QR, delegates and signatures · self-service kiosk · recipient portal · outgoing mail with courier pickup sheets and cost centres · reports with CSV and PDF · WhatsApp (manual and automatic) · optional AI · four roles, audit log and backups · English and Spanish.

Credits

Bundled open-source components (Bootstrap, Bootstrap Icons, jQuery, Chart.js, Dompdf, PHPMailer, jsQR, qrcode-generator, Signature Pad and the Inter font) and their licenses are listed in licenses/index.html.

Support

Use the support tab on the item's CodeCanyon page. Please include your PHP and MySQL versions, the Collecto version and the system report (System → Health → Copy system info).