TIL: Your Mac keeps a secret log of everything you do, and you can ask it questions

There's a "secret" snitch on your machine. It lives at ~/Library/Application Support/Knowledge/knowledgeC.db and it has been recording what you do on your Mac the whole time:

• which app is in front
• when you switched and for how long
• when the screen turned on and off
• what was playing
• which pages you opened in Safari.

I knew Screen Time existed. I didn't know the raw data behind it and behind Siri Suggestions was sitting in a plain SQLite file I could open.

The one-prompt version

Open Codex, Claude Code, or whatever agent you use and paste this:

look at ~/Library/Application Support/Knowledge/knowledgeC.db and tell me some interesting facts

The agent finds the file, figures out the schema, runs a pile of queries, and comes back with a report. Mine confirmed something I suspected but hadn't measured:

Codex went from 6.1% of my app time in April to 21.9% in September so far. I'm moving hard to Codex. The rest of the report covered my most used apps, when I start and stop working, how often I bounce between windows, and how many hours a day the screen is lit.

What's in there

The database belongs to CoreDuet, the part of macOS that powers Siri Suggestions and app predictions. Nearly everything is in one table, ZOBJECT, and the ZSTREAMNAME column tells you what kind of event a row is. Streams you'll find on a Mac include:

• /app/inFocus and /app/usage: which app was in the foreground, with start and end times
• /app/webUsage: time spent per domain in Safari
• /safari/history: URLs opened in Safari
• /display/isBacklit: screen on and off
• /device/isLocked and /device/isPluggedIn: lock state and charging
• /media/nowPlaying: what was playing and in which app
• /notification/usage: notifications received
• /siri/ui and /app/intents: Siri and Shortcuts activity
• /bluetooth/isConnected and /audio/outputRoute: connected devices and where the audio goes

For app events, ZVALUESTRING holds the bundle ID (com.apple.Safari, com.google.Chrome, and so on). Timestamps are seconds since January 1, 2001, which is the Core Data convention, so add 978307200 to get a Unix timestamp.

There's also a system-wide copy at /private/var/db/CoreDuet/Knowledge/knowledgeC.db, but the per-user one is where the interesting stuff is.

Query it yourself

If you'd rather not hand the whole thing to an AI:

sqlite3 -readonly ~/Library/Application\ Support/Knowledge/knowledgeC.db

Total foreground hours per app:

SELECT
  ZVALUESTRING AS app,
  ROUND(SUM(ZENDDATE - ZSTARTDATE) / 3600.0, 1) AS hours
FROM ZOBJECT
WHERE ZSTREAMNAME = '/app/inFocus'
GROUP BY app
ORDER BY hours DESC
LIMIT 15;

Your most recent app switches, with readable timestamps:

SELECT
  datetime(ZSTARTDATE + 978307200, 'unixepoch', 'localtime') AS start,
  datetime(ZENDDATE + 978307200, 'unixepoch', 'localtime') AS end,
  ZVALUESTRING AS app
FROM ZOBJECT
WHERE ZSTREAMNAME = '/app/inFocus'
ORDER BY ZSTARTDATE DESC
LIMIT 20;

Swap in any stream name from the list above and you have a different report.

If you get "authorization denied"

The Knowledge folder is protected by macOS privacy controls. The process that opens the file needs Full Disk Access, and "the process" means the actual terminal app your agent is running inside: Terminal, iTerm, Ghostty, Warp, or your editor if you use its built-in terminal. Go to System Settings, then Privacy & Security, then Full Disk Access, and add it. Without that, even ls on the folder fails with a permission error. I hit that from a shell inside Cursor while writing this.

How far back it goes

The forensics writeups on this database (Sarah Edwards' mac4n6 blog is the main one) quote about four weeks of retention for the busier streams, but that number comes mostly from iPhones. On my Mac the app usage data went back to April, so five months. It varies by stream and by macOS version.

The data never leaves your disk when you query it with sqlite3. When you run the prompt above with a cloud agent, the query results do go to the model provider. It's your own usage history, so decide how you feel about that before you paste.