Every Mac running macOS 13 or later ships with a pair of undocumented background daemons whose only job is to build a graph about who you are, who you know, how those people are related to you and to each other, how you communicate with them, where you go and when. Security researchers Dario Pasquini and Michał Bazyli published the analysis on the blog 8rank.ai, describing how the system works from macOS 13 (2022) onward and releasing a free dashboard called iKnow that lets any Mac user inspect their own graph.
The two daemons, knowledgeconstructiond and intelligenceplatformd, keep their output in ~/Library/IntelligencePlatform, a directory of 51 SQLite databases stored in plaintext. The main one, graph.db, cross-references Contacts, Calendar, Photos, Messages, Mail, location, Screen Time and many behavioural signals. Apple's only public description is a brief man page; the researchers say there is almost no documentation of which macOS versions run it or what exactly is collected.
How the Mac knowledge graph works
The system stores facts as subject-predicate-object rows. The subject is a person, app or event; the object is a value or another entity. A relationship such as "employer" is split across two rows sharing a relationshipId, one naming the kind of relationship and one pointing at the other entity, which allows each edge to hold its own confidence score and to be retracted later.
The 46 relationship type classes in the system are what make kinship inference possible: the graph does not just record who you contact, it infers how they are related to you and to each other. The researchers call this a family member classifier, and note that Apple's own 2023 research paper on graph construction never mentions the kinship inference at all.
- knowledgeconstructiond: builds the general purpose knowledge graph, per Apple's man page
- intelligenceplatformd: handles heavy processing tasks alongside it
- Storage: ~/Library/IntelligencePlatform, 51 SQLite databases in plaintext under TCC Full Disk Access
- graph.db: triple store using 181 entity classes and 278 predicates
