PROPELOO

MOBILE / PRODUCT ENGINEERING

Build mobile products that hold up under real-world use.

PROPELOO engineers mobile products — iOS, Android and React Native — designed for the constraints that matter: unreliable networks, background limitations, battery budgets, App Store governance and the crash-free rate requirements of a product users open every day.

The mobile product that works in the demo breaks in the taxi. Real-world conditions are not edge cases.

Offline state management, background sync, push notification reliability under poor network, crash-free rate requirements, App Store review cycles — each requires deliberate architecture decisions made early. Rebuilding offline-first in month six costs five times what it costs in week two. PROPELOO designs mobile architecture for the constraints of the real world before writing the first screen.

What sits underneath a production mobile product.

A mobile app is not a website on a smaller screen. It is a constrained computing environment with network unreliability, battery budgets, background limitations and platform governance that shape every architecture decision.

System Layers

  • UI / Screen Layer: SwiftUI / UIKit, Jetpack Compose, React Native components, design system, navigation, accessibility
  • State Management Layer: Local state, global state, offline queue, optimistic UI updates, conflict resolution
  • Network & Sync Layer: API client, request queuing, offline detection, background sync, retry logic, websocket management
  • Device & Platform Layer: Push notifications, camera, location, biometrics, background tasks, keychain/keystore
  • CI/CD & Distribution Layer: Automated builds, App Store / Play Store submission, TestFlight beta, version management, crash reporting

Core Technical Capabilities

  • iOS Native — Swift & SwiftUI

    Production iOS applications with Swift and SwiftUI — following Apple HIG, supporting the latest iOS features, App Store compliance and CI/CD pipeline to TestFlight and App Store Connect.

  • Android Native — Kotlin & Compose

    Production Android applications with Kotlin and Jetpack Compose — material design 3, Play Store compliance, multiple screen density support and CI/CD to Play Console.

  • React Native Cross-platform

    Single codebase for iOS and Android with React Native — near-native performance, shared business logic, platform-specific modules where native capability is required, and Expo or bare workflow.

  • Offline-first Architecture

    Optimistic UI with background sync, local persistence (SQLite, Realm, CoreData), conflict resolution for concurrent edits and graceful degradation when the network is unavailable.

  • Push Notification Infrastructure

    APNs and FCM integration, notification payload design, deep link routing, notification grouping, badge management and delivery analytics for engagement and transactional notifications.

  • App Store CI/CD Pipeline

    Automated build, test and submission pipelines with Fastlane, GitHub Actions or Bitrise — including code signing automation, TestFlight distribution, Play Store track management and version control.

How we think about mobile product engineering.

Mobile development is not a platform choice. It is a set of constraints — network unreliability, battery budget, background limitations, App Store governance — that shape every architecture decision.

  • Offline-first or offline-broken

    A mobile product that requires continuous connectivity fails in the subway, in lifts and in areas with poor signal. Offline-first architecture — local persistence, optimistic UI, background sync — is an architectural commitment made in week one, not a feature added in month six.

    Axiom:

  • Performance is a feature

    A mobile app that feels slow will be uninstalled. 60fps animations, sub-300ms navigation transitions, <3 second cold start and responsive touch interactions are not nice-to-haves — they are the minimum bar for a product users return to daily.

    Axiom:

  • App Store is a deployment partner

    Apple and Google review cycles, entitlement requirements, privacy manifest obligations and in-app purchase rules affect the architecture. Products built without understanding App Store governance encounter rejection at the worst possible moment.

    Axiom:

  • Crash rate determines retention

    A crash-free rate below 99.5% creates visible negative reviews. Every crash is a context switch from your product to the operating system. Crash monitoring, symbolication, and root cause analysis must be part of the delivery process — not post-launch discovery.

    Axiom:

The decisions that define a mobile product.

These choices affect performance, platform capability access, team structure and long-term maintenance cost.

  • Native iOS/Android vs React Native vs Flutter

    Impact: Native gives best performance and full platform access. React Native is the right default for most products — the performance gap is negligible for standard UIs. Flutter makes sense when cross-platform pixel-perfect consistency matters more than platform conventions.

    • Native iOS (Swift/SwiftUI) + Android (Kotlin/Compose) — best performance, full platform API access, two codebases, higher team cost
    • React Native — near-native performance, shared JS/TS codebase, JavaScript bridge overhead for complex animations, large ecosystem
    • Flutter — compiled performance, single Dart codebase, custom rendering engine, growing ecosystem, less native look-and-feel
    • Expo (React Native managed) — fastest to start, some native module constraints, excellent for most products
  • Offline-first vs online-only architecture

    Impact: Offline-first requires local database, conflict resolution strategy and sync infrastructure. Retrofitting this after launch is the most expensive mobile refactor. Decide in week one.

    • Online-only — simplest, breaks without connectivity, acceptable for connectivity-required use cases
    • Cache-first — read from local cache, background refresh, no write offline capability
    • Offline-first — full read/write offline, background sync, conflict resolution required
  • REST vs GraphQL for mobile API

    Impact: GraphQL reduces data payload and round trips for complex screens. On mobile, reducing payload size over cellular connections has measurable impact on perceived performance.

    • REST — simple, cacheable, over-fetching on complex screens
    • GraphQL — exact data per screen, reduces over-fetching, more complex backend
    • tRPC — type-safe end-to-end TypeScript, monorepo only
  • Push notification provider

    Impact: Push notification deliverability is not guaranteed by any provider. Delivery analytics, retry logic for failed deliveries and rate limiting are required regardless of provider.

    • Direct APNs + FCM — no vendor, requires managing two SDKs and delivery infrastructure
    • Firebase Cloud Messaging — Google-managed, covers both platforms, analytics included
    • OneSignal / Braze — managed, rich analytics, segmentation, higher cost at scale
  • Local storage: SQLite vs Realm vs CoreData vs MMKV

    Impact: Storage choice determines offline data query capability and sync complexity. Changing storage libraries at scale requires data migration and is extremely disruptive.

    • SQLite (via expo-sqlite or FMDB) — universal, well-understood, verbose queries
    • Realm — object-based, fast, real-time sync option, licensing considerations
    • CoreData (iOS native) — Apple-native, complex API, good SwiftUI integration
    • MMKV — key-value only, extremely fast, no relational queries
    • WatermelonDB — React Native optimised, lazy loading, good for large datasets
  • Analytics and crash reporting

    Impact: Crash reporting with symbolication is non-negotiable for a production mobile product. Analytics provider choice affects GDPR posture and the kinds of questions you can answer about user behaviour.

    • Firebase Analytics + Crashlytics — free, deep Google integration, data sent to Google
    • Mixpanel / Amplitude — product analytics focus, event-centric, per-event pricing
    • Datadog Mobile — engineering focus, infrastructure correlation, higher cost
    • Sentry — error tracking focus, source maps/symbolication, open source option

What mobile product engineering becomes.

  • Consumer FinTech App

    Mobile banking or payments product with biometric authentication, offline balance viewing, push notifications for transactions and App Store / Play Store compliance for financial apps.

  • On-demand Service App

    Driver/courier or service provider mobile app with real-time location, job dispatch, offline task completion, background location tracking and battery-efficient location updates.

  • Enterprise Field Tool

    Field operations app with offline-first data collection, background sync when connectivity is restored, camera/barcode integration, role-based access and MDM compatibility.

  • Healthcare Telemedicine App

    HIPAA-compliant telehealth product with video calling (WebRTC), encrypted local storage, biometric auth, App Store medical category compliance and EMR integration.

  • Social / Community App

    Social product with real-time feeds, push notification engagement, media upload optimisation, infinite scroll performance and in-app content moderation tooling.

  • IoT Companion App

    Bluetooth LE or Wi-Fi device companion app with device discovery, pairing flow, background characteristic monitoring, firmware update and real-time telemetry display.

The mobile engineering stack.

Platform choice drives the stack. We select tooling based on the performance requirements, team structure and feature set — not preference.

  • iOS

    Stack: Swift 5.9+, SwiftUI, UIKit, Combine, CoreData, XCTest / XCUITest

  • Android

    Stack: Kotlin, Jetpack Compose, Room Database, Coroutines / Flow, WorkManager, Espresso

  • React Native

    Stack: React Native 0.73+, Expo, React Navigation, Zustand / Redux, WatermelonDB, MMKV

  • Networking & Sync

    Stack: Axios / React Query, Apollo GraphQL, WebSocket (Socket.io), Background Fetch, Optimistic UI

  • Device & Platform

    Stack: APNs / FCM Push, CoreLocation / FusedLocation, LocalAuthentication, Keychain / Keystore, AVFoundation / Camera2, CoreBluetooth / BLE

  • CI/CD & Monitoring

    Stack: Fastlane, GitHub Actions, App Store Connect API, Firebase Crashlytics, Sentry, TestFlight / Play Console

Mobile security is where data lives closest to the user — and closest to the attacker.

Mobile devices are personal. The security model must protect user data under device compromise, network interception and malicious app scenarios.

  • OWASP Mobile Top 10

    Insecure data storage, improper platform usage and insufficient authentication are the most common serious mobile vulnerabilities. OWASP Mobile Top 10 review is standard on every production mobile engagement.

  • Certificate Pinning

    SSL certificate pinning prevents man-in-the-middle attacks on cellular and untrusted Wi-Fi networks. Certificate rotation procedures must be designed alongside pinning — a pinned certificate with no rotation plan creates a future outage.

  • Secure Local Storage

    Sensitive data stored in UserDefaults, SharedPreferences or plain text files is accessible to other apps on a rooted/jailbroken device. The iOS Keychain and Android Keystore provide hardware-backed encrypted storage for tokens, keys and PII. Use them for everything sensitive.

  • Jailbreak & Root Detection

    Jailbroken and rooted devices bypass OS-level security controls, making local storage accessible and SSL interception trivial. Detection mechanisms — file path checks, hook detection, integrity verification — add friction for attackers targeting your app specifically.

  • Biometric & PIN Authentication

    Biometric authentication (Face ID, Touch ID, fingerprint) integrated via LocalAuthentication / BiometricPrompt provides phishing-resistant local authentication. The fallback chain (biometric → PIN → password) must be explicitly designed — weak fallbacks undermine biometric security.

  • On-device Data Encryption

    Sensitive app data should be encrypted at rest using device-hardware-backed keys, separate from OS-level device encryption. Encryption keys must be stored in the Keychain/Keystore and tied to biometric authentication where the data sensitivity warrants it.

From product concept to app store launch.

  1. 01. Platform & Architecture Decision

    Native vs React Native analysis, offline-first requirements, performance requirements, device API needs and App Store category compliance review.

  2. 02. Architecture & Design System

    State management design, network layer architecture, local storage strategy, navigation structure and design system / component library setup.

  3. 03. Core Feature Engineering

    Authentication, core screens, API integration, local persistence and state management — built with crash monitoring and analytics from day one.

  4. 04. Device & Platform Integration

    Push notifications, device APIs (camera, location, biometrics), background tasks and platform-specific features aligned to iOS HIG and Material Design guidelines.

  5. 05. Offline & Performance Engineering

    Offline state management, background sync, optimistic UI, performance profiling (frame rates, cold start, memory) and network condition testing.

  6. 06. Security Review & App Store Prep

    OWASP Mobile Top 10 review, certificate pinning, secure storage audit, App Store / Play Store metadata, privacy manifest, screenshots and submission checklist.

  7. 07. Launch & Monitoring

    App Store / Play Store submission, TestFlight/beta distribution, crash monitoring activation, push notification testing, OTA update strategy and post-launch performance baseline.

Frequently Asked Questions

Should we build native iOS/Android or use React Native?

React Native is the right default for most products. A shared JavaScript/TypeScript codebase reduces development and maintenance cost significantly, and performance is near-native for standard UI interactions. Choose native when: you need complex animations at 120fps, you require deep integration with platform-specific APIs unavailable in React Native (e.g., specific ARKit features, HealthKit granular access), or your product has extreme performance requirements (real-time video processing, game rendering). The productivity advantage of React Native outweighs native performance for 80%+ of mobile products.

Do we need offline support?

Ask: what happens when a user opens the app with no internet connection? If the answer is 'the app shows an error' — do you accept that for your use case? Consumer apps where users expect to view their data (banking app showing balance, food app showing order history) need at minimum read-offline with cached data. Apps used in the field (logistics, healthcare, field service) need full offline read/write with sync. Offline-first is an architectural commitment — it cannot be added as a feature later without a significant rebuild.

How long does an App Store review take?

Apple App Store reviews typically take 24-48 hours for new apps and updates, with expedited review (1-2 days) available for critical bugs affecting users. Rejected submissions require a resubmission cycle that adds 2-5 days. Google Play reviews typically take 1-3 days. Both stores have extended review times around holidays and for apps in sensitive categories (financial, health, kids). Build App Store review time into your launch planning — do not plan a same-day release after submission.

How do we ensure a high crash-free rate?

Crash-free rate above 99.5% requires: crash monitoring from day one (Firebase Crashlytics or Sentry with symbolication), automated regression testing for core user flows, device fragmentation testing on physical devices or a device farm, memory pressure testing to catch low-memory crashes, and a triage process for crash reports within 24 hours of detection. The goal is never to ship a regression that causes visible crashes — automated testing and crash monitoring together prevent the majority of preventable crashes.

What are App Store privacy requirements we need to prepare for?

Apple requires a Privacy Manifest (PrivacyInfo.xcprivacy) declaring all data collected and its purpose, an App Privacy label in App Store Connect accurately reflecting all tracking and data collection, permission usage strings for every sensitive API (camera, location, contacts, etc.) and App Tracking Transparency framework for any advertising tracking. Google Play requires a data safety section in the Play Console. Both stores actively reject submissions with inaccurate privacy declarations. We build privacy compliance into the architecture, not as a last-minute checklist.

How do we handle push notifications reliably?

Push notification reliability requires: APNs and FCM direct integration with your backend, notification payload design that works with background processing (content-available for silent pushes, alert notifications for visible ones), retry logic for failed deliveries, delivery receipt tracking, notification permission request timing (never on first launch — request after demonstrating value), and separate notification types for engagement vs transactional. Notification open rate and delivery rate should be monitored as product metrics.

How do we support multiple languages and regions?

Internationalisation (i18n) requires: all user-facing strings extracted to localisation files (NSLocalizedString on iOS, strings.xml on Android), layout testing for languages with longer strings (German, Finnish) and RTL support for Arabic and Hebrew markets. Localisation should be set up from the first sprint — retrofitting i18n onto a product with hundreds of hardcoded strings is a week-long task per language. If international markets are in scope, we design for localisation from day one.

What is the difference between TestFlight and App Store distribution?

TestFlight is Apple's beta testing platform — you upload a build to App Store Connect, add testers by email or public link, and they install via the TestFlight app. TestFlight builds expire after 90 days and require a build review that is lighter than full App Store review but still takes 24-48 hours. App Store distribution is for production release — requires full App Store review and full privacy metadata. Google Play has equivalent Internal Testing, Closed Testing and Open Testing tracks with different review requirements and user access controls.

How do we implement in-app purchases correctly?

In-app purchases (StoreKit 2 on iOS, Play Billing Library on Android) require: product configuration in App Store Connect/Play Console, receipt validation on your backend against Apple/Google servers to prevent fake purchase claims, subscription state management for renewals and cancellations, handling of family sharing and promotional offers, and server-to-server notifications for subscription lifecycle events. Apple takes 15-30% of in-app purchase revenue and enforces its in-app purchase requirement strictly for digital goods.

How long does a mobile app take to build?

A production mobile app with authentication, core features, API integration, offline support, push notifications and App Store submission takes 14-22 weeks from architecture to launch. Simple utility apps with 3-5 screens take 8-12 weeks. Complex apps (real-time features, custom hardware integration, extensive offline) take 20-32 weeks. React Native apps sharing 70%+ code across iOS and Android save 30-40% vs native dual builds. We deliver in two-week sprint cycles with TestFlight/beta releases at each milestone.