Undocumented macOS daemons build an on-device graph of your family and friends, analysis finds

Daemons most users have never heard of

According to an analysis published on Eighth Rank, every Mac shipped since 2022 runs two background daemons, knowledgeconstructiond and intelligenceplatformd, whose purpose is to construct a structured model of the user and the people around them: who they know, how those people relate to one another, how they communicate, where they go and with whom, and what they do and when. The researchers say they hit on the mechanism in August 2026 while examining the Apple Intelligence bundle in macOS 26, and that Nic Lydon had independently discovered the same database a few months earlier and published his own write-up. The findings were gathered on macOS 26.6.2.

Almost no official documentation

Per the write-up, Apple documents almost none of this. The closest thing to official documentation is the manual page for knowledgeconstructiond, which says only that the daemon examines on-device content to help construct a knowledge graph describing the user and the machine, with intelligenceplatformd handling part of the heavier processing. Apple's own researchers published a paper on the graph-construction techniques in 2023, but according to the analysis there is nothing official on how the system is wired into macOS, which versions run it, exactly what is collected, or how kinship is inferred.

Where the data lives

The daemons keep their output in ~/Library/IntelligencePlatform: fifty-one SQLite databases stored in plaintext, inside a zone protected by macOS's Full Disk Access permission. The most significant of them, graph.db, is a triple store built on a vocabulary of 181 entity classes and 278 predicates. Each row ties a subject to an object through a predicate stating the relationship the system believes holds; every edge carries a confidence value, its sources and a timestamp, which is what allows an inferred relationship to be retracted later, the researchers explain.

What feeds the graph

The graph is populated from nearly everything the operating system can read: Contacts; faces in Photos; Calendar event titles and attendees; Family Sharing membership, including the age of every member; the emergency contact stored in the Health app's Medical ID; people and events that Siri Suggestions extracts from Mail and Messages; contacts donated by third-party apps through App Intents; and the installed app list.

Beside the graph sit separate tables recording who appears with whom in photos; a communication log covering who, when, which app and which direction — metadata only, with no message content — that also pulls in data from the user's other devices; location and movement; and a stream of device signals such as screen-lock state, Wi-Fi, Bluetooth, charging and ambient light. One such stream, ContextualUnderstanding.PhysicalSocial, defines records listing people by name, phone number and email address, each with a start and end time, which the researchers read as a log of who was physically near the user — though they say they never saw it populated in practice.

Of the 181 entity classes, 57 describe activities such as sleeping, exercising, mindfulness, commuting and dining, meaning nearly a third of the vocabulary covers what the user is doing rather than who or where they are. The researchers caution that some classes may be declared placeholders that never get filled, and that their assessment of which classes are actually implemented is inference rather than verified fact.

How relationships are inferred

Simple entries are copied from sources or produced by rules, but the sensitive conclusions come from models. According to the analysis, a pair of XGBoost classifiers decides who counts as family based on 144 mostly behavioral features; two embedding models are one of ten signals used to judge whether two records describe the same person; twelve Photos analyzers score partner, parent, child, coworker and friend from who appears in the user's pictures and on which trips and holidays; and Apple's on-device LLM reads messages to attach names and relationships to people. The finished store is, allegedly, queryable by LLMs.

A dashboard, and a warning

Alongside the analysis, the researchers released iKnow, an open-source local dashboard that lets Mac owners inspect the contents of their own knowledge graph. They also run a thought experiment on abuse: a dataset this complete concentrates a user's private life in one place, and if it landed in the wrong hands it could be turned against them — for instance by pairing it with an LLM whose safety training has been stripped away.

Why it matters

The finding is a reminder of how much silent inference now happens on consumer devices. Apple's on-device approach is genuinely different from cloud-based profiling in important ways: the data stays on the machine, it sits behind Full Disk Access, and message content is excluded from the communication log. But the same design funnels a cross-referenced map of a user's family, friendships, movements and daily habits — complete with confidence scores attached to kinship guesses and ages pulled from Family Sharing — into plaintext databases on every Mac, with almost no public documentation of what is collected or how. That combination cuts both ways: it limits who can read the data while making the device itself the single repository of everything a person's social life implies. Tools like iKnow at least make the invisible visible; the deeper question the analysis leaves Apple to answer is why a system this consequential shipped with a single paragraph of documentation.