Apple Knowledge Graph: What Your Mac Learns About Your Family

The Apple knowledge graph is a database macOS builds on your Mac from your contacts, communication history and photos, and researchers say it feeds two models that score whether each person is likely to be family. A write-up by 8rank.ai, dated October 28, 2026, found it in 51 plaintext SQLite databases (ordinary, unencrypted database files) under ~/Library/IntelligencePlatform. Each of the two family classifiers takes 144 features, from a shared last name to the age of a person in your photos.

So the real issue is Apple Intelligence privacy on your own disk. The researchers did not show the macOS knowledge graph leaving the Mac. What they did show is that it is detailed, stored in plain files, undocumented by Apple in anything we could find, and slower to forget than you might expect. Apple has not commented in any source we found.

The post reached number one on Hacker News with 820 points on November 9, 2026. One caveat on sourcing: the 8rank.ai report is the researchers' own account of files on their machines, a single secondary report rather than an Apple statement, and we found no independent reproduction yet. Below, we keep two things apart: what the researchers saw in the files, and what they guessed. Most of the confusion around this story comes from mixing the two.

What is a knowledge graph?

A knowledge graph is a way of storing facts as links between things. People, places and events are the points, and each link has a name that says how two points relate. Every fact is a short three-part sentence (subject, predicate, object), such as "Person A, worksAt, Company B". A database made only of those three-part facts is called a triple store.

Apple's version, a file called graph.db, is that kind of triple store, according to 8rank.ai. The ontology Apple ships with macOS (the rulebook of which kinds of things and relationships can exist) declares 181 entity classes and 278 predicates. The researchers are careful here: a class being declared does not mean your Mac has filled it, and they could not tell whether every class is populated.

They were not the first to find it. In a dev.to post dated May 7, developer Nic Lydon described the same kind of database on his own laptop. He counted 40,339 subject-predicate-object records in one table, 3,970 significant_contact records and 353,744 records across Apple's tables. Those are figures from one machine, not an average for every Mac.

A note-taking knowledge graph, like the ones people build from Apple Notes or Obsidian on purpose, is a different idea. The store in this story is built by macOS itself, and Apple Notes is not among the example features the researchers published for the family models.

What the Apple knowledge graph holds: observed vs inferred

The table below sorts every major claim by how solid it is. "Observed" means the researchers point to a file, a model or Apple's own man page. "Inferred" or "unclear" means they say so themselves.

The headline finding is the pair of family models. Their files are named EntityTagging_Family.mlmodelc and EntityTagging_FamilyAndFriends.mlmodelc. Both are binary XGBoost classifiers: XGBoost is a common type of machine-learning model built from many small decision trees, and "binary" means each one gives a yes-or-no style score. Example inputs include sameLastName, sharesHomeAddress, iCloudFamilyMember and photosPersonAge.

The scores land in entityTagging.db, one row per person, with 17 relationship columns that the researchers say are recomputed daily. Only 2 of those 17 columns have a shipped model behind them. The authors could not trace how the other 15 get filled.

The communication log records who you talked to, when, in which app and in which direction. According to the authors, it does not record what was said.

Deletion is where the findings get uncomfortable. Remove a contact and it leaves the live graph, but the retracted rows move to a table called expired_stable_graph, still carrying their confidence scores and sources. The researchers infer that pruning happens after about 48 hours, yet they found very old records on their own Mac. Both things are in their write-up, and they do not resolve the conflict.

One widely shared example needs a warning label. The scenario of a Mac working out a child, a daycare and a family schedule came from an LLM correlating synthetic data, the authors say. It shows what the data could support. It is not something they found on a real machine.

Where does macOS store the knowledge graph?

macOS stores the knowledge graph in ~/Library/IntelligencePlatform, the IntelligencePlatform folder inside your user Library, according to 8rank.ai. The folder holds 51 SQLite databases, and the researchers describe them as plaintext: the files themselves are not encrypted, so any process allowed to open them can read them.

That permission is the main lock. The folder is protected by TCC Full Disk Access (TCC is macOS's Transparency, Consent and Control system, which asks before an app reaches private data). In practice, an app needs Full Disk Access before it can read these files. That is our reading of what the protection means, not a test the researchers report against a specific app.

The man page for knowledgeconstructiond on macOS 26.6.2, build 25G83, says the daemon analyzes on-device content to build a knowledge graph. That sentence is the closest thing to Apple documentation in this story, and it comes from Apple's own software on the machine.

Version matters too. The researchers tested on macOS 26.6.2 and 26.7.1, and only partly on 27.0.1, so file names or layout may differ on newer releases.

SyntaxRadar calculation: what the family score is built from

We broke down the 144 features using the counts in the 8rank.ai write-up. The percentages are our arithmetic, shown with the inputs.

More than half of the inputs come from your photo library. Identity signals, the kind you might expect a "family" label to rest on (same surname, same address, iCloud Family), are fewer than one in seven. One caution: this is a count of features. The sources do not report how heavily the model weighs any single feature, so the photo share shows where the inputs come from and says nothing about which ones decide the score.

Two more derived numbers frame the gaps. Only 2 of the 17 relationship columns have a shipped model, so 15 of 17, or 88%, are filled in ways the researchers could not trace. And the write-up sat for 12 days, from October 28 to November 9, 2026, before it topped Hacker News.

Does Apple Intelligence run locally?

For the part covered here, the evidence says yes: the knowledge graph is built and kept on your Mac. Apple's own man page says knowledgeconstructiond analyzes on-device content, and the files sit in your user folder. The researchers presented no evidence that the graph leaves the machine, though they also say they cannot tell how other services consume it.

So when people ask "does apple intelligence run locally on Mac", these sources answer only part of it. They cover one system, this graph and its classifiers. They do not test every Apple Intelligence feature, so they cannot settle whether all of it runs on the device. Our explainer on on-device AI and why phones are running models locally covers the wider trade-off this story only touches.

On-device is the better privacy starting point, because the data stays with you. A local store can still be detailed, readable by anything with the right permission and slow to delete, and that is what the researchers describe. Our explainer on what botnets are shows the other failure mode, where a home device's hidden activity did leave the house, which is exactly what has not been shown here.

How do I check what my Mac knows about me?

You can check what your Mac knows about you by reading the IntelligencePlatform databases with a tool that has Full Disk Access. The 8rank.ai authors built one for this: a read-only dashboard called iKnow, written with only Python's standard library. It binds to 127.0.0.1, which means it serves its pages to your own machine and not to the network.

Before running it, note the limits the authors set out. It was tested on macOS 26.6.2 and 26.7.1 and only partly on 27.0.1. And because the data sits behind Full Disk Access, the dashboard needs that permission to see anything. Granting Full Disk Access to any program is a real decision, so read the code first or wait for a tool you trust. Our guide to whether Plaid is safe to use walks through the same who-can-read-my-data question for bank accounts.

What you will not find in these sources is a tested off switch or a way to wipe the graph. The deletion finding also means removing a contact may not remove every trace of it right away.

What to watch next

The biggest open item is Apple. As of November 9, 2026, we found no Apple statement or documentation of the family classifiers. Any response would answer what the researchers could not: how the other 15 relationship columns are filled, which services read the store, and how long expired records really last.

Also watch the researchers' testing on macOS 27, which is only partial so far, and whether others reproduce Nic Lydon's single-machine counts. Until then, the fair summary is that the Apple knowledge graph is real, on-device and more detailed than most users knew, and much of how it is used is still unknown.