You don’t need https for a web running locally; nothing goes into the network. Malicious browser extension can be real, but if that is true, you might have bigger problems than leaking the apple graph
It is in plaintext, but protected by TCC (so, only privileged apps / trusted by you can). Not sure about persistence. I believe it is rewritten periodically, possibly ignoring your edits
Yes, but having some kind of documentation and way to disable it would have been reasonable. Also, the thing is that it seems that apple intelligence models can query this information. So, you know, everything is a prompt injection away in theory.
Ack. For what I could see, specific tables are added / removed across versions. So, some information might not be visualized (e.g., the graph is tiny with few nodes).
The output stays local on your disk (in theory). So I’m not sure that breaks any rule. But in theory, Apple Intelligence can query it. Again, close to 0 documentation, so it is hard to know how this is consumed.