Your Mac and your Windows PC keep a diary of everything you do: how to read it and how to switch it off

Your computer keeps a diary of you, and it is not the browser history. macOS writes down which app was in front of you and for how long, to the second, when the screen went on and off, which sites Safari opened and which notifications you got; on macOS 26 it does this in two places, a database called knowledgeC and 118 "Biome" streams that cover the clipboard, Wi-Fi, location and Siri requests. Windows records every program you started from the Start menu with a counter and a timestamp, the last eight launches of every executable, a month of per-app network traffic and, on Copilot+ PCs, screenshots every few seconds. None of it leaves the machine by default, which is the problem as much as the reassurance, because whoever gets the machine gets the diary. Below is what is stored, a script for each system to read your own copy, and what can be switched off.

What a Mac remembers, and how to read it

Apple's forensic community has documented knowledgeC.db since 2018, when researcher Sarah Edwards described it as the best "pattern of life" source on a Mac. It is the store behind Screen Time and Siri Suggestions. Each row in its ZOBJECT table is an event with a stream name, a start and an end: /app/usage is the app that had focus and for how long, /display/isBacklit is the screen turning on or off, /app/webUsage and /safari/history are browsing, /notification/usage is what pinged you. On our test Mac running macOS 26.6 the database held 757 events going back four weeks for app usage and five months for some streams. It reported 113 hours in Chrome, 5.7 in Terminal, 2.4 in Telegram, and a complete timeline of when the display was on, down to a three-minute session at 21:25 on a Friday. Since macOS Catalina, Apple has moved most of this into Biome, a framework Howard Oakley described in 2022 as the machinery behind suggestions: ~/Library/Biome/streams holds one folder per stream, and the stream names are a list of what is watched: App.InFocus, App.WebUsage, Pasteboard.Change, Device.Wireless.WiFi, Location.MicroLocationVisit, Notification.Usage, Media.NowPlaying, Siri.Query, ProactiveHarvesting.Safari.PageView, ProactiveHarvesting.Mail, ProactiveHarvesting.Messages, ProactiveHarvesting.Notes, ScreenTime.AppUsage, TextUnderstanding.Deletions.Document. Biome files are a binary format called SEGB; forensic tools parse them, ordinary users cannot, but their presence and size are easy to check.

The script below copies the database to a temporary folder (macOS locks the live file) and prints the summary. Give Terminal Full Disk Access first (System Settings, Privacy & Security, Full Disk Access), and take it away afterwards if you don't need it: that permission is what lets any app read the diary.

#!/bin/bash
# What this Mac remembers about you. Read-only.
T=$(mktemp -d)
cp ~/Library/Application\ Support/Knowledge/knowledgeC.db* "$T"/ 2>/dev/null || { echo "No access: give Terminal Full Disk Access first"; exit 1; }
DB="$T/knowledgeC.db"
echo "== Time in focus per app, last 7 days (hours)"
sqlite3 -column "$DB" "SELECT ROUND(SUM(ZENDDATE-ZSTARTDATE)/3600.0,1) AS hours, ZVALUESTRING AS app FROM ZOBJECT WHERE ZSTREAMNAME='/app/usage' AND ZSTARTDATE > strftime('%s','now','-7 days')-978307200 GROUP BY app ORDER BY hours DESC LIMIT 15;"
echo "== Screen on/off, last 15 events (local time)"
sqlite3 -column "$DB" "SELECT datetime(ZSTARTDATE+978307200,'unixepoch','localtime') AS at, CASE ZVALUEINTEGER WHEN 1 THEN 'on' ELSE 'off' END AS screen, ROUND((ZENDDATE-ZSTARTDATE)/60.0) AS minutes FROM ZOBJECT WHERE ZSTREAMNAME='/display/isBacklit' ORDER BY ZSTARTDATE DESC LIMIT 15;"
echo "== Every stream in the database: records and oldest entry"
sqlite3 -column "$DB" "SELECT ZSTREAMNAME AS stream, COUNT(*) AS records, datetime(MIN(ZSTARTDATE)+978307200,'unixepoch') AS oldest FROM ZOBJECT GROUP BY 1 ORDER BY 2 DESC;"
echo "== Biome streams that hold data"
for d in ~/Library/Biome/streams/restricted/*/local; do n=$(ls "$d" 2>/dev/null | grep -c '^[0-9]'); [ "$n" -gt 0 ] && echo "$(basename "$(dirname "$d")"): $n file(s), $(du -sh "$d" | cut -f1)"; done
rm -rf "$T"

Turning it down on a Mac

Apple offers no switch labelled "stop logging". What exists are the features the logs feed, and each can be turned off. Screen Time is the obvious one: System Settings, Screen Time, turn it off if you don't use it, and it stops building its own usage database. Siri Suggestions is the bigger source: System Settings, Apple Intelligence & Siri, "Siri Suggestions & Privacy", and there for every app switch off "Learn from this application" and "Show Siri Suggestions in application"; that is the setting Apple's own text describes as "allow Siri to learn from how you use this application". The knowledgeC and Biome stores keep existing for the system's own purposes, so the second step is to delete them when you want a clean start: in Terminal run rm ~/Library/Application\ Support/Knowledge/knowledgeC.db* and rm -r ~/Library/Biome/streams/*, then restart; macOS recreates empty stores. The third step matters more than the first two. Open System Settings, Privacy & Security, Full Disk Access and read the list: every app there can read the diary and everything else in your home folder. Keep FileVault on, keep the screen locking after a few minutes, and give guests their own account; the logs are per user, and a locked, encrypted Mac hands them to nobody.

What Windows remembers, and how to read it

Windows spreads the diary across several places, each documented by forensic examiners because each survives what the user thinks of as deleting. UserAssist, a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist, records every program started through the Start menu or Explorer with a run count, a focus count and the time of the last launch; the names are stored in ROT13, a letter shift that hides nothing from anyone who knows it. Prefetch, in C:\Windows\Prefetch, keeps a file per executable with its last eight run times, up to 1,024 programs. SRUM, the System Resource Usage Monitor at C:\Windows\System32\sru\SRUDB.dat, is the log behind Task Manager's "App history": about a month of bytes sent and received and energy used, per application, whether you looked or not. Activity history, in ActivitiesCache.db under your local profile, stores the apps, files and sites you opened; Microsoft dropped the option to upload it in January 2024 but the local copy remains. And on Copilot+ PCs, Recall takes "a snapshot of your active screen every few seconds and when the content of your active window changes", indexes the text and images, and stores them locally behind Windows Hello. It is opt-in and removed by default on managed devices, and it can be filtered by app and website; it is still a searchable film of everything you looked at.

# What this PC remembers about you. Read-only. Run PowerShell as administrator for Prefetch and Recall.
function Rot13([string]$s){ -join ($s.ToCharArray() | ForEach-Object { $c=[int]$_; if($c -ge 65 -and $c -le 90){[char]((($c-65+13)%26)+65)} elseif($c -ge 97 -and $c -le 122){[char]((($c-97+13)%26)+97)} else {[char]$c} }) }
Write-Host "== UserAssist: programs started from Start or Explorer (runs, last run)"
Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist' | ForEach-Object {
  $count = Join-Path $_.PSPath 'Count'
  if (Test-Path $count) {
    (Get-ItemProperty $count).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' -and $_.Value -is [byte[]] -and $_.Value.Length -ge 68 } | ForEach-Object {
      $b = $_.Value; $runs = [BitConverter]::ToInt32($b, 4); $ft = [BitConverter]::ToInt64($b, 60)
      if ($runs -gt 0 -and $ft -gt 0) { [pscustomobject]@{ Runs=$runs; LastRun=[DateTime]::FromFileTime($ft); Program=(Rot13 $_.Name) } }
    }
  }
} | Sort-Object LastRun -Descending | Select-Object -First 25 | Format-Table -AutoSize
Write-Host "== Prefetch: last 20 programs Windows saw start"
Get-ChildItem C:\Windows\Prefetch -Filter *.pf -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name, LastWriteTime | Format-Table -AutoSize
Write-Host "== Activity history and SRUM databases"
Get-ChildItem "$env:LOCALAPPDATA\ConnectedDevicesPlatform" -Recurse -Filter ActivitiesCache.db -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize
Get-Item C:\Windows\System32\sru\SRUDB.dat -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize
Write-Host "== Recall (Copilot+ PCs only)"
Get-WindowsOptionalFeature -Online -FeatureName Recall -ErrorAction SilentlyContinue | Select-Object FeatureName, State

Turning it down on Windows, and the part that is not technical

Four settings cover most of it. Settings, Privacy & security, General: switch off "Let Windows improve Start and search results by tracking app launches"; that stops new UserAssist entries, and the old ones stay until you delete the Count keys under UserAssist in the Registry Editor. Settings, Privacy & security, Activity history: switch off "Store my activity history on this device" and press "Clear history". On a Copilot+ PC, Settings, Privacy & security, Recall & snapshots: turn off saving snapshots and delete them, or remove the feature entirely in "Turn Windows features on or off", which Microsoft says deletes all saved snapshots. Prefetch and SRUM have no switch: Prefetch can be disabled in the registry at the cost of slower starts, and SRUM is rebuilt by the Diagnostic Policy Service whenever its file is removed. As on the Mac, the defence that holds is BitLocker or Device Encryption with a strong sign-in and a screen that locks, plus a separate standard account for anyone else who uses the machine.

Two things follow from all this for anyone who cares about privacy. The first is that "local only" is a promise about the cloud, not about you: Apple and Microsoft are right that these stores don't leave the device, and the stores are still the most complete record of your day that exists anywhere. The second is that the same permission that lets you read them lets any tool read them, which is why handing an AI assistant Full Disk Access or administrator rights to "analyse your habits", as the viral prompts suggest, means sending four weeks of your life to whichever model answers. Read the diary yourself; the scripts above are enough.