Researchers at The Eighth Rank (Dario Pasquini and Michał Bazyli) say every Mac runs two background services, knowledgeconstructiond and intelligenceplatformd, that build a personal knowledge graph about the user and the people around them. Their write-up, published in late October, reached about 846 points and 449 comments on Hacker News this weekend. Apple's only documentation is a short man page describing a daemon that builds "a general purpose knowledge graph". None of the coverage includes a response from Apple.
What is in it: the data sits in ~/Library/IntelligencePlatform as about 51 plaintext SQLite databases, protected by macOS's Full Disk Access permission. The main one, graph.db, holds 181 entity classes and 278 relationship types, each row with a confidence score. The researchers say it draws on Contacts, Photos (faces), Calendar, Messages, Mail, location, Screen Time and device signals.
The family classifier: two XGBoost models shipped as CoreML decide who counts as family, using features such as a shared last name, a shared home address, the iCloud Family flag and age difference. A DEV Community summary of the research says they use 144 features and score 17 relationship columns, from "family" and "mother" to "coworker", recalculated daily. People who never agreed to anything — anyone who emailed you, appears in your photos or was invited to your meetings — are included.
What is and isn't confirmed: everything runs on the device; the researchers do not say data leaves the Mac. They collected their data on macOS 26.6.2 and say the system has existed "allegedly" since macOS 13 (2022); they describe parts of their mapping as inference. They also found that deleted entries linger in an expired_stable_graph table (about 48 hours in their measurements), that users have no documented way to view or correct the inferences, and they argue the store would be a single rich target if an attacker or a malicious app got Full Disk Access. A similar store exists on iOS.
