UPDATE π¨ : guys we built another securities platform if you want to read it go here : https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b
Most people think you need a MacBook, cloud credits, and a team of engineers to build a generative AI product.
My co-founder Akhouri (13) and I (12) just proved that wrong. We built and launched ACA, a privacy-first virtual try-on app, entirely using a $150 Android phone, Termux, and pure stubbornness.
But we almost didn't make it. Here is the story of our pivot.
Phase 1: The Illusion of Path A
We started by trying to run Virtual Try-On (VTON) entirely in the browser. We used MoveNet (TensorFlow.js) to extract skeletal keypoints and Barycentric Triangle Warping to stretch a 2D garment image over the user's body.
It was a disaster.
Akhouri ran 54 systematic tests and 13 alternative approaches. Every single one failed. The fabric didn't bend, the shadows didn't match, and it looked like a paper cutout floating in the air.
My co-founder sent me a message: "ACA is hard or impossible in this case. All paths are impossible."
Phase 2: The Termux Trenches
I refused to give up. 86.6% of people don't use virtual try-on because they don't trust companies with their photos. We had to solve this.
I tried to build a local Trusted Execution Environment in Termux. What followed was a week of pure technical hell:
- Hit
No matching distribution foundtrying to install MediaPipe. - Node.js threw
Cannot find module 'glob', breaking npm entirely. - Google Cloud slammed a 13+ age verification wall in my face.
- I was debugging blind on a 4-inch screen with no Chrome DevTools.
Phase 3: The Pivot (Split Inference)
We realized trying to force a massive diffusion model onto a POCO C55 was like fitting a V8 engine into a bicycle.
So, we pivoted to a Split Inference Architecture:
- The phone handles the UI (Vanilla JS, 60fps Canvas).
- Supabase handles Auth and strict Row-Level Security (RLS).
- The cloud handles the heavy lifting via the IDM-VTON Diffusion Model (using the
@gradio/clientto bypass CORS and join the Hugging Face GPU queue via WebSockets).
The Magic Moment
I fixed the image extraction logic. I uploaded a photo and a clean polo shirt. I hit generate.
The progress bar said: In Queue... waiting for GPU...
I waited 60 seconds.
Then, the log flashed: β AI Generation Complete!
The canvas rendered. The AI had generated fabric folds, shadows, and perfect lighting matching the background. Not a sticker. Not a warp. Photorealistic.
We literally screamed. We did it.
Here is the exact output from that session:
(1. The Garment Input)
(2. The Original User Photo)
(3. The ACA Generated Output)
A Note on Privacy: You'll notice the faces in our test images are blurred. This isn't a bug; it's a feature. ACA is built on a strict privacy-first philosophy. We don't harvest biometric data, and we don't train our models on our users' faces. Even when testing our own app with family, we protect their identities. When you use ACA, your face belongs to you, not our servers.
The Reality of v1.0
We are live at https://aca-vto.netlify.app/.
Is it perfect? No.
- The Hugging Face token is currently baked into the client-side JS (it's read-only, but a Cloudflare Worker proxy is scheduled for v1.1).
- Free public GPUs mean a 20-40s wait time.
But it works. Itβs a fully functional SaaS product with authentication, database persistence, and generative AI, built with zero budget and deployed entirely from a mobile phone.
To anyone who says you need expensive hardware to build AI: you don't. You need a terminal, and the stubbornness to keep going when the code says "impossible."
We are just getting started. π―π
(Shoutout to the HYNAWEB engineering team: Akhouri Anmol Kumar, CTO)



Top comments (12)
awesome work as usual. i do have some questions though:
Your pitch is βyour photo never leaves your phone,β but in v1.0 the photo is sent to a public Hugging Face Space. Who can access uploaded images there, how long are they retained, and have you told users this before they upload? If itβs the latter, how does the privacy-first claim hold up?
Isnβt βsplit inferenceβ normally a model partitioned across device and server? Here the phone only handles the UI and the full model runs remotely, which is just a standard client-server call to a hosted API. What does the split mean in practice, and what part of the pipeline is yours rather than IDM-VTONβs?
The token being in the client bundle is fine as a stopgap, but βread-onlyβ doesnβt protect your GPU quota. Anyone can pull it from the bundle and burn through it. Have you rotated it since publishing, and is there rate limiting in place until the Worker proxy ships?
Oh π
Failed.
I consider it as Specious product.
Why is everyone roasting him this much π
was i too harsh as well? haha
you did absolutely great, you should be more harsher next time
you did what is necessary.
How are you guys building stuff this fast π€― I remember you writing a post here about the plan, and instantly it's done?!
haha, pure stubbornness and a lot of late nights in termux! π
but honestly, the speed came from a massive, necessary pivot. we realized running a full diffusion model locally was hitting a hard hardware wall on budget phones. so we implemented a split inference architecture.
itβs actually a concept currently in active research for privacy-focused vton: the phone handles the ui, strict data control, and auth, while the cloud handles the heavy diffusion lifting via secure websockets. it let us ship the privacy-first promise without melting the device or compromising the user's biometric data.
glad you checked it out! the journey from "all paths are impossible" to "β AI Generation Complete" was wild. π―π
product is just specious
Superhero π
Some comments may only be visible to logged-in visitors. Sign in to view all comments.