Somewhere in ~/Library on your Mac there is a SQLite file with one row for every person you know. Each row has seventeen relationship columns, and two of them are filled in by XGBoost models that guess whether that person is family. The scores are recomputed every day by a daemon called knowledgeconstructiond. Nothing in System Settings mentions any of this.
If you got here because knowledgeconstructiond was eating your CPU in Activity Monitor, or because you searched for how to turn off the Apple Intelligence personal knowledge graph: the Apple Intelligence toggle doesn't stop it. The daemon has shipped since macOS 13 Ventura, two years before Apple Intelligence existed, and it runs on Intel Macs that can't run Apple Intelligence at all. Below is what it collects, where it keeps it, how to read your own copy, and which switches actually do something.
What knowledgeconstructiond does with your contacts, messages and photos
The details come from a long teardown by Dario Pasquini and Michał Bazyli at 8rank, tested on macOS 26.6.2 (build 25G83), and from the Hacker News thread about it, which passed 750 points and 400 comments.
Two daemons do the work. knowledgeconstructiond and intelligenceplatformd have shipped on every Mac, Intel and Apple silicon, since macOS 13 Ventura in 2022. The closest thing to official documentation is the man page:
man 8 knowledgeconstructiond It says the daemon "analyzes the content on this device to help build a knowledge graph representing the device and the user," and nothing more. Apple researchers published a 2023 paper on the Saga platform that mentions serving private personal knowledge on-device, but it says nothing about kinship inference or which macOS versions run it.
According to the teardown, the graph pulls from Contacts, Photos, Calendar, Messages, Mail, Family Sharing, Health (Medical ID), Screen Time, location and device signals. It stores subject-predicate-object triples, each with a confidence from 0 to 1, across 181 entity classes and 278 predicates. About 57 of those classes describe things you do, such as sleeping, commuting and eating out.
The family part is two CoreML models that ship with the ontology:
EntityTagging_Family.mlmodelcEntityTagging_FamilyAndFriends.mlmodelc
Both are binary XGBoost classifiers over 144 numeric features. Twenty of those are identity features like sameLastName, sharesHomeAddress, iCloudFamilyMember, ageDifferenceCategory and nicknameContainsEmoji. Forty come from communication patterns: who you contact, on which days, at which times of day. The remaining 84 come from Photos, meaning who shows up in your pictures next to you.
Only two of the seventeen relationship columns have a shipped model behind them. The authors couldn't work out how the other fifteen (things like mother and coworker) get filled. And when Apple Intelligence is on, an on-device LLM reads your Messages to suggest a name and a relationship for unnamed faces in Photos. Those show up as the predicates nm_suggestedName and nm_suggestedRelationshipToDeviceOwner.
Where the graph lives: ~/Library/IntelligencePlatform
~/Library/IntelligencePlatform The teardown counted 51 SQLite databases in there. The ones worth knowing:
| File | What it holds |
|---|---|
graph.db | The triple store itself |
ontology.db | Decodes the predicate codes into names |
entityTagging.db | Family scores, one row per person, 17 relationship columns, recomputed daily |
Deleted facts don't disappear right away. Retracted rows move into a table called expired_stable_graph and keep their confidence and sources. The authors estimated about 48 hours of retention from a prune watermark, but one of them could still read very old records there on their own Mac. On iOS the same store sits under /private/var/mobile/Library/IntelligencePlatform.
The folder is protected by TCC, so you need Full Disk Access to read it. Your Terminal can't see it by default, which is probably the main reason so few people knew it was there.
How to see what your Mac thinks about your family
First, give your terminal Full Disk Access: System Settings → Privacy & Security → Full Disk Access, add Terminal (or iTerm, or your editor), then quit and reopen it. The permission only takes effect at launch.
Then confirm the daemon exists and see what's on disk:
pgrep -l knowledgeconstructiond launchctl print gui/$(id -u)/com.apple.knowledgeconstructiond | head -20 find ~/Library/IntelligencePlatform -name '*.db' | head -60 If you want to poke at the raw SQLite, open it read-only so you don't fight the daemon over locks or corrupt anything:
DB=$(find ~/Library/IntelligencePlatform -name 'entityTagging.db' | head -1) sqlite3 -readonly "$DB" '.tables' The easier route is the authors' open-source viewer, iKnow. It uses only the Python standard library, binds to 127.0.0.1, opens everything read-only and writes nothing:
git clone https://github.com/8rank/iKnow.git cd iKnow python3 server.py It prints ok or DENY next to each store on startup, which tells you right away whether Full Disk Access took. The README lists it as tested on 26.6.2, 26.7.1 and 27.0.1, with 27 only partly working because Apple keeps changing the schemas. The repo also ships MANUAL_FOR_YOUR_AGENT.md for pointing a coding agent at your data, and to its credit it warns that the agent sends what it reads to its model provider. wat10000 on HN noticed the irony. If you go that way, use a local model. Sending your family graph to a cloud API to find out what your Mac knows about your family is a strange way to protect your privacy.
How to turn off knowledgeconstructiond, and which switches don't work
Going by the sources and user reports:
| What you try | Does it stop the classifier? |
|---|---|
| Turn off Apple Intelligence | No. The daemons predate it by two years and run on Intel Macs that never had it. It probably does stop the LLM face-naming step, which the teardown says only runs when Apple Intelligence is active. |
| Disable Siri | No. MacRumors users reported knowledgeconstructiond hitting 100% CPU on Siri-disabled Macs in 2022 and 2024. |
| Turn off "Learn from this application" per app | Reduces inputs. Probably doesn't stop the daemon. |
| Quit it in Activity Monitor | Temporary. It comes back on its next scheduled run, per Plumby. |
launchctl disable | Only with SIP off. |
| Delete and lock the folder | Unsupported, consequences unknown. |
The supported, partial fix: go to System Settings → Apple Intelligence & Siri (just Siri on older macOS) → About Siri, Dictation & Privacy, and switch off "Learn from this application" for Messages, Mail, Photos, Contacts and anything else you care about. Intego points out that not every app shows up in that list. This gives the daemon less to chew on. Nobody has shown that it empties entityTagging.db, so check with iKnow afterwards instead of assuming.
For the SIP route, MacRumors user bogdanw posted this, noting it only works with System Integrity Protection disabled:
launchctl bootout gui/501/com.apple.knowledgeconstructiond launchctl disable gui/501/com.apple.knowledgeconstructiond The 501 is the user ID of the first admin account. Replace it with your own from id -u. The same post disables com.apple.siriknowledged and com.apple.knowledge-agent the same way. I wouldn't run a daily-driver Mac with SIP off to get rid of one daemon. That trades a privacy problem you can at least inspect for a security hole across the whole system.
Then there's the folder lock. One HN commenter, jftuga, deletes ~/Library/IntelligencePlatform, puts an empty file with the same name in its place, hands it to root:wheel, sets it to 444 and adds chflags schg (the last three steps need sudo). Another user, bayganyo, said they applied it too. Nobody in the thread reported what breaks afterwards, and another commenter believes the store gets rewritten periodically. Nobody has mapped which system features read from this store, so expect side effects. If you try it, think of it as an experiment you may have to undo.
You also can't correct the graph. The teardown says there's no general way to fix a wrong inference, so if the model decides your landlord is family, your landlord stays family.
On-device is not the same as asking
To be fair to Apple, this is all on-device. wat10000 made that point on HN, and it's a fair one. Your family graph isn't being shipped off to an ad network the way Facebook's social graph is.
But "it's local" answers a different question from "why didn't you ask me?" Apple sells privacy as a feature and then ships a kinship classifier that rescores everyone you know daily, next to a graph that reads your Messages and your Medical ID, documented in a few lines of man page, with no switch. josephg put it best in the thread: there's a big difference between choosing to use a tool and having the tool quietly start analysing you. The infrastructure is already sitting there. An opt-in screen and a "forget everything" button would cost Apple next to nothing.
So, run iKnow and tell me: did it get your family right? Did anyone land in a category that made you wince? And would you rather Apple had asked first, or is local-only good enough for you?
