Anatomy of Apple's Personal Knowledge Graph: Undocumented Data Collection on macOS

The Hidden Knowledge Graph on macOS

Since 2022, every Mac has shipped with a pair of background daemons—knowledgeconstructiond and intelligenceplatformd—designed to build a comprehensive, queryable knowledge graph about the user and their social circle. This system aggregates data from across the operating system, including Contacts, Calendar, Photos, Messages, Mail, location history, and Screen Time, to infer relationships, habits, and behavioral patterns. While Apple has published research papers on graph construction techniques, the specific implementation details, the scope of collected data, and the existence of a "kinship" inference engine remain largely undocumented.

How the System Operates

The knowledge graph is stored in ~/Library/IntelligencePlatform as a series of SQLite databases. The core of this system is a triple store containing 181 entity classes and 278 predicates. These predicates record relationships between entities, such as "employer," "family member," or "social connection."

Inference is performed through a mix of:

• Rule-based extraction: Copying data directly from system apps.
• Machine Learning models: Including XGBoost classifiers for family relationship detection and embedding models to identify when two records represent the same person.
• Local LLMs: Used to interpret messages and photos to assign names and relationship labels to face clusters.

Crucially, the system assigns a confidence score to every inferred fact, and even when data is deleted by the user, the system often retains the information in an expired_stable_graph table, which may persist for extended periods.

Privacy and Ethical Concerns

The discovery of this system has prompted significant debate regarding user consent and data transparency. Critics argue that the collection of such granular social and behavioral data—without an explicit, granular opt-in mechanism—violates the spirit of user privacy.

"If I'm having a chat with someone, there's a milieu constructed around the fact that not everything will be remembered verbatim... With Recaps and this social graph, the informal fluidity in the way we relate to one another starts to go away." — Hacker News user @thomascountz

Legal observers have also noted potential conflicts with regulations like the GDPR, as data provided for specific purposes (e.g., sending an email or organizing a meeting) is being repurposed for profiling without explicit user consent. Furthermore, because this graph is stored in a location accessible to any process with Full Disk Access, it creates a potential "privacy single point of failure" where malicious software could theoretically scrape a user's entire social network and behavioral history.

Investigating Your Own Data

To provide transparency, researchers have open-sourced iKnow, a local dashboard that allows users to browse the contents of their own knowledge graph. The tool runs locally on the Mac, reading the databases in a read-only state to visualize the connections the system has made.

Key findings from users who have inspected their data include:

• Cross-device synchronization: The graph can link identities across multiple Macs if the user is signed into the same iCloud account.
• Third-party app integration: The system may ingest metadata from third-party messaging apps, such as Slack or WhatsApp, to build its social graph.
• Inaccurate inferences: Many users report that the system frequently makes incorrect assumptions about family relationships or social ties, highlighting the limitations of the automated inference models.

While some users argue that this local processing is preferable to cloud-based surveillance, others remain concerned that the lack of documentation and the inability to easily opt out or clear this data constitutes a fundamental breach of trust. As one user noted, "On a long enough timeline, all closed-source software turns into spyware."