A voice assistant that sees your Mac — and keeps the work there.

Your voice goes through Apple's on-device SFSpeechRecognizer or WhisperKit-Large running on your Apple Silicon. The microphone never opens a socket. The transcript never reaches a server because there isn't one.

Your screen goes through a 4-billion-parameter vision model (Qwen3-VL) that lives on the same chip. Screenshots are processed in-memory and freed. In local mode, nothing is uploaded, cached, or analyzed off your machine.

Conversation memory, durable facts, journals, flows, and taught skills are ordinary local files under ~/Library/Application Support/Pace/. You can inspect or remove them yourself. Their at-rest protection is the protection configured for your macOS account and disk; Pace does not pretend that local storage is automatically encrypted by the app.

Flows are the literal tier. You record a sequence of clicks and keystrokes once; Pace replays them verbatim through the Accessibility tree. Same buttons, same order, every time — perfect when the layout never moves.

Recipes are flows Pace already ships. Say "install the morning standup recipe" and a pre-built sequence copies into your library, ready to run. No recording, no setup.

Skills are the flexible tier, and the part people conflate with the other two. A skill is a numbered list of steps in plain language — not recorded clicks. Pace re-reads your screen and re-plans it every single run, so a skill still works after a button moves or a menu gets renamed. Teach one by talking ("teach a skill that files my expense report") or by filling in a short form. The description is structured into a file by the on-device planner — the same local pin meeting notes use. A taught skill never leaves the Mac.

The planner runs on your Mac out of the box — free, private, no key. For the rare turn that wants a heavier model, Settings → Planner lets you pick a tier: Apple's Foundation Models, your authenticated Codex or Claude CLI, or a bring-your-own-key API. The key lives in the macOS Keychain, never in a file or a log.

Off-device is opt-in and it's loud about it. The moment a turn leaves the machine, the menu-bar capsule tints amber and a line lands in the local audit log — the same log the Privacy dashboard reads to keep its byte count honest. Deep research and scheduled tasks default to phoning a friend (Codex), but only after you've consented and a soak window has passed; otherwise an unattended fire falls back to the local planner.

Going off-device even buys back RAM. When the planner isn't resident on your Mac, the Models tab shows the freed budget and recommends the largest local vision model that now fits — so choosing a cloud brain can make Pace's eyes sharper without sending your screen anywhere.

Say "start meeting mode." Pace records your mic and the other side's audio as two separate 16 kHz tracks — never mixed — and splits them into you said / they said turns. Transcription runs on your Apple Silicon: WhisperKit if you've put the model on disk, Apple Speech if you haven't.

When you stop, a local model writes the summary, action items, and decisions. That model is privacy-pinned: even if you've pointed Pace's planner at a cloud tier for other work, meeting synthesis can't use it. The pin is in the code path, not a setting you could fat-finger.

A week later, ask "what did we decide in standup?" and Pace answers from the notes on disk. Recordings and notes prune themselves after your retention window — 30 days unless you move the stepper in Settings.

Every change Pace can undo leaves a 5-second undo banner next to the cursor — created a note, drafted a mail, added a reminder, edited a field. Tap it and the change rolls back. You don't have to remember what it did; the escape hatch shows up on its own.

Missed the answer? A replay button sits under the panel for 30 seconds and speaks the exact same words back — it replays the audio, it doesn't re-run the planner, so you hear what you already heard, not a fresh guess.

When something breaks — planner offline, a permission missing, a click that didn't land, the TTS sidecar down — Pace says so in plain language. That copy is written deterministically, not by a model, and it stays quiet when you're on a call.

And the whole privacy claim is measured, not asserted. The in-app Privacy dashboard reads a local audit log and shows the exact bytes sent off your Mac, broken out by surface. It says zero until an off-device tier you turned on actually fires — then it says how much, and to whom.