Your Mac keeps a guess about who your family is. A 2017 exam ruling says a guess about you is yours to see.

What is knowledgeconstructiond? It is a background process that has shipped with macOS since Ventura in 2022. Its own manual page says it "analyzes content on the device to build a general purpose knowledge graph." On 28 October 2026 two security researchers, Dario Pasquini and Michał Bazyli, published what is inside that graph. By their account it scores the people in your life as family, partner, parent, child or coworker, using shared surnames, who you message and when, and who appears in your photos with you. It also fills in birthdays nobody typed. Apple has not described any of this, and as far as I can find, no macOS settings page shows it.

What did the researchers find?

Their write-up, on the Eighth Rank site, reached 776 points on Hacker News after it was posted there on 7 November. Two daemons, knowledgeconstructiond and intelligenceplatformd, keep their work in a folder called ~/Library/IntelligencePlatform: fifty-one SQLite databases, behind macOS's Full Disk Access protection. The main one, graph.db, is written in "a vocabulary of 181 entity classes and 278 predicates."

The part that got attention is the family classifier. According to the write-up, it gives each person scores across seventeen relationship columns, from "family" to "mother" to "coworker", with a confidence between 0 and 1. It draws on 144 features: 20 about identity (shared surname, address, email domain, an iCloud Family flag), 40 about communication, and 84 from photos. One field is a birthday "filled in rather than told," apparently from a photo age estimate.

The folder itself isn't a secret. People have asked about it for years: in a 2024 Apple Community thread, one user found graph.db had grown past 4 GB and rebuilt itself after being deleted. Another replied: "Nobody actually knows what those tasks do." And Apple-affiliated researchers described the approach in a 2023 paper about building "private personal knowledge on-device."

How sure are the researchers?

Less sure than the headline. They write that their mapping of which mechanism fills which field should be taken as "inference work rather than ground truth." Only two of the seventeen relationship columns had a model they could trace. And the scores can be wrong in a way they show: the scorecard still rated two people the graph had dropped the day before, both known only from a calendar invite.

That matters for what follows. This is a careful outside reading of an undocumented system, not Apple's description of it.

My first reaction

My first reaction was that this is fine because it stays on the Mac. Several people on Hacker News said the same: Siri needs to know which James you mean when you say "text James." Better a local graph than a cloud one.

Then I tried to answer a simpler question. If a Mac has decided that someone is your brother with a confidence of 0.7, where can you read that? The answer is nowhere Apple provides. You need Full Disk Access, an SQLite browser, or the researchers' open-source reader. And if the guess is wrong, there's no button to correct it. On-device answers who can see the data. It doesn't answer whether the person it describes can.

What does an exam ruling have to do with it?

In 2017 the Court of Justice of the European Union decided a case brought by Peter Nowak, a trainee accountant who failed an Institute of Chartered Accountants of Ireland exam for the fourth time in 2009, asked for all his personal data and was refused his exam script. The question was whether an examiner's margin notes are the candidate's personal data.

The court said yes. Personal data covers "not only objective but also subjective" information, "in the form of opinions and assessments," as long as it relates to the person. The examiner's comments qualify: their content "reflects the opinion or the assessment of the examiner," and they "are liable to have effects for the candidate." Seeing them lets the candidate check whether they're accurate and whether they should be kept.

Hold that next to the Mac. A relationship score is an assessment, made by someone other than you, about you and the people around you. It isn't something you said. It was worked out from your messages and photos, and it can be wrong, as the researchers showed. That's what an examiner's comment is.

The comparison breaks in one place. Nowak knew there was an examiner and could write to the Institute, which is what he did. On a Mac, the examiner is a process with no interface. You can't ask to see the comments if you don't know there's a script.

So can you see it?

Technically yes, practically no. The data is on your disk. Reading it takes tools most people won't use, and the fields are in Apple's internal vocabulary. Deleting a contact doesn't clean up everything either: according to the write-up, retracted rows move to a table called expired_stable_graph and stay until you remove them by hand.

Whether EU access rights reach any of this is a question I can't settle. Nowak was about an organisation holding your exam. Processing that happens only on your own device, with nothing sent to Apple, may not have a controller in the usual sense at all. That gap is the interesting part, and I don't think the law has caught up with it.

What would fix most of it is small: a page in System Settings that lists what the Mac thinks it knows about each person, with the confidence, and a way to say "wrong."

I wrote about a version of this when Gyazo's breach leaked descriptions of screenshots rather than the screenshots: derived data tends to outlive the thing it came from. And when Claude Code put users' email addresses into web requests, the issue was the same kind of quiet inference about who you are.

How sure am I?

More on Daily Ferment: The Gyazo breach leaked the description of your screenshots, not the screenshots and Claude Code handed websites your email. HTTP said not to in 1996.

Sources

• Dario Pasquini and Michał Bazyli, Every Mac comes with an (undocumented) family member classifier, Eighth Rank, 28 October 2026.
• Hacker News discussion, 7 November 2026.
• What is Graph.db in the ~/Library/IntelligencePlatform, Apple Community, January and February 2024.
• Ihab F. Ilyas and others, Growing and Serving Large Open-domain Knowledge Graphs, arXiv 2305.09464, May 2023.
• Court of Justice of the European Union, Case C-434/16, Peter Nowak v Data Protection Commissioner, judgment of 20 December 2017.