Every Mac sold since 2022 ships with a pair of background daemons — knowledgeconstructiond and intelligenceplatformd — whose sole function is to build a structured knowledge graph about you. The graph lives in ~/Library/IntelligencePlatform as a directory of 51 SQLite databases, stored in plaintext behind macOS's TCC Full Disk Access gate. The most significant database, graph.db, is a triple store with 181 entity classes and 278 predicates. Every row encodes a subject, a predicate, and an object — people, organizations, events, locations, activities — linked by typed relationships that carry their own confidence scores and provenance metadata. The inputs are vast. The daemons pull from Contacts, Calendar events and attendees, Photos (face recognition), Messages, Mail, Family Sharing (including ages of family members), the Medical ID emergency contact from Health, Siri Suggestions, App Intents donations from third-party apps, installed app inventories, communication logs (who, when, which app, direction — no content), location and movement data, Screen Time, and an array of device signals including Wi-Fi, Bluetooth, ambient light, and charging state. A stream named ContextualUnderstanding.PhysicalSocial logs people by name, phone, and email with start and end times — structured like a record of who was physically near you, though the researchers never saw it populated. What makes this more than a data warehouse is the inference layer. The 181 entity classes include not just core types (person, place, event, organization) but granular activity classes: working, meeting, eating, sleeping, exercising, gaming, socializing, commuting, dining, vacationing, reading, shopping, going to bed, waking up, mindfulness, FaceTime calls, driving, hiking, and attending performances. Attribute classes cover sex, religion, political party, profession type, language, and mode of transportation. The system doesn't just store what you told it — it infers what you do and when, cross-referencing behavioral signals into typed activity events. The relationship model is particularly revealing. The graph uses 46 relationship type classes to encode edges between entities, each carrying its own confidence score. Employment relationships link a person to an organization through a typed intermediary. Kinship inference — who is related to whom and how — exists in the schema, though Apple has said nothing publicly about it. The architecture is designed so that edges can be retracted later as confidence changes, meaning the graph is a living, evolving model of your social world, not a static snapshot. Apple's stated purpose is to feed this graph to Apple Intelligence's LLM retrieval pipeline. The man page says it plainly: the daemon builds "a general purpose knowledge graph" representing "the device and the user." The researchers at Eighth Rank, who reverse-engineered the system during security research on the Apple Intelligence bundle in macOS 26, have open-sourced a local dashboard called iKnow that lets users read the contents of their own graph. Their analysis also runs a thought experiment on weaponization: if such a knowledge base were exfiltrated and combined with an uncensored LLM, the privacy threat extends far beyond data theft into targeted social engineering at a level most users have never considered. The documentation gap is the structural issue. Apple published a 2023 research paper on graph construction techniques but has provided essentially no disclosure about which macOS versions run the daemons, what is collected versus inferred, or how the kinship inference works. The man page is two sentences. This means roughly three years of Macs have been building comprehensive personal knowledge graphs with no meaningful user-facing transparency about scope, inference depth, or retention. The data is local and encrypted at rest behind Full Disk Access, which Apple frames as a privacy win — but the concentration of this much structured personal intelligence in a single queryable store creates a privacy single point of failure that changes the threat model for device compromise. The honest question is not whether on-device is better than cloud — it is. The question is whether building the most detailed structured model of a person's life ever attempted by a consumer OS, with no user-facing documentation of what is inferred and no opt-out granularity, constitutes informed consent. The graph doesn't just know your contacts. It models your employer, your family ages, your routines, your physical proximity to named individuals, and your activity patterns at a resolution that would make most users deeply uncomfortable if they could see it — which, until iKnow, they couldn't.
