Every Mac comes with an (undocumented) family member classifier

Since macOS 13, two Apple system daemons have built an on-device knowledge graph about the Mac’s owner and their connections, drawing on data across the operating system. Analysis of macOS 26 found 51 SQLite databases in the user’s IntelligencePlatform folder; the files are plaintext but protected by macOS Full Disk Access controls. The central graph database stores entities and relationships using 181 classes and 278 predicates, with confidence, source, and timestamp information attached to its records. Inputs include Contacts, Photos, Calendar, Family Sharing, Health, Mail and Messages suggestions, app-provided data, and installed apps. Separate tables track photo co-occurrences, communication metadata, location and movement, and device signals. Communication records include who contacted whom, when, through which app, and in which direction, but not message contents.

The system’s purpose is to infer who people are, how they relate, how and when they communicate, and what they do and where they go. Its database and macOS integration are largely undocumented, and the analysis identifies a family-relationship or “kinship” inference capability absent from Apple’s public descriptions. The researchers explain the graph’s structure and data sources, while distinguishing mechanisms they verified from classes they could not confirm. They also release iKnow, a local dashboard for inspecting one’s own graph, and consider the risks if this concentrated store of personal and social information were exposed or used alongside a modified language model.