We shipped an AI feature that refuses to run on phones. On purpose.

We build a PDF toolkit that runs entirely client side. There is no upload endpoint on the domain, so documents are never transmitted. That constraint is the whole product.

Two months ago we added on-device AI: summarize a PDF, ask it questions, translate it. The setup:

- A 1.5B parameter model running in the browser through WebGPU

- Executes on the user's own GPU, inside a sandboxed worker

- Weights are ~850 MB, downloaded once, cached in IndexedDB

- After that first download, it works with no network at all

Then we hit the obvious problem. A phone cannot run it. Not enough VRAM. Loading it can crash the tab.

The tempting fix was a fallback. If the device is too weak, send the text to a server and return the answer. Two lines of config. Nobody would notice. Every competitor does exactly this, and it would have made the feature work for most of our traffic, since most of our users are on mobile.

We made it refuse instead. On a phone, the tool detects that the device cannot run the model, explains why, and does nothing. No degraded mode. No quiet upload.

The reasoning:

A privacy guarantee with an exception is not a guarantee, it is a default. And that exception would fire precisely for the users least likely to inspect what happened.

The cost was real. We turned off our newest feature for most of our audience.

What surprised us is what happened after:

- The refusal message became the thing people screenshot and share

- A Spanish tech blog covered us unprompted and is still our second largest traffic source two months later

- ChatGPT now appears in our referrer logs, recommending us when people ask for private PDF tools

So, a real question for this forum:

Have you ever shipped a constraint that cost you reach, and did it pay back? Or did you take the fallback and never hear a single complaint?