Flutter & React Native Apps in the UK

About Flutter & React Native Apps

Our React Native and Flutter development services take a cross-platform iOS and Android app from first screen to store release. We use Flutter when polish and 60fps animations matter, and React Native when speed-to-market and shared code with the web matter more. From MVP launches to enterprise apps with 100k+ users, we handle the full lifecycle: design, native module integration, App Store and Play Store submission, push notifications, analytics, and ongoing version updates.

What the engagement includes

• Flutter app development (iOS + Android)
• React Native app development (iOS + Android)
• Native module development for platform-specific features
• Push notifications (FCM, APNS, OneSignal, Firebase)
• In-app purchases and subscription billing (RevenueCat, native IAP)
• Real-time features via WebSockets or Firebase
• Offline-first apps with sync (SQLite, WatermelonDB, Realm)
• Maps and location services (Google Maps, Apple Maps, Mapbox)

Children's defaults, user content duties and the store rules a UK cross-platform app meets

The UK question to settle first is whether children are likely to use the app, because that decides its defaults, and children here means anyone under 18. The ICO's Age Appropriate Design Code has 15 standards, and three of them land directly in mobile code: settings high privacy by default, profiling switched off by default, and geolocation switched off by default with an obvious sign to the child whenever location tracking is active. The geolocation standard adds that any option making a child's location visible to others should default back to off at the end of each session. A phone app has no natural end to a session, because the operating system suspends it rather than closing it, so we define one in the lifecycle events Flutter and React Native both expose, usually a set time in the background, and reset sharing there. The obvious sign is native work underneath the shared code. On iOS the blue status bar indicator for background location is off by default for an app holding Always authorisation and has to be switched on, and on Android location work that carries on in the background runs as a foreground service, which the system requires to show a notification. Since 5 February 2026 the Data (Use and Access) Act 2025 has also required a controller providing an online service likely to be accessed by children to take account of children's higher protection matters when deciding what data protection by design requires. The ICO's August 2026 progress report shows what it checks: in its review of popular mobile games it looked at whether privacy and discoverability settings were high privacy by default, whether location sharing was off by default and whether profiling for targeted advertising was off by default. In a cross-platform build those defaults are best held on the server per account, so one decision reaches both apps at once. Whether your app is likely to be accessed by children is for your own counsel.

If users can post, message or upload to each other, the Online Safety Act 2023 applies whatever the size of the business, provided the service has links to the UK. Ofcom's illegal content duties have been in force since 17 March 2025, and every regulated user-to-user service needs systems that let users and affected people easily report illegal content. Every such service also has to carry out a children's access assessment, and Ofcom's guidance gives a service that came into scope after 16 January 2025 three months from the first day it was available to UK users to complete it. A service may conclude that children cannot access it only if it uses highly effective age assurance, and Ofcom says that terms of service restricting the service to over-18s do not count. Where children are likely to use it, the Protection of Children Codes have applied since 25 July 2025, covering content moderation, recommender systems and user reporting and complaints. Fines reach £18 million or 10 per cent of qualifying worldwide revenue, whichever is greater. In a cross-platform build the report entry point sits on every piece of user content in both apps, built once as a shared component so the iOS and Android flows cannot drift apart, while the moderation queue, the takedown action and the record of each decision live on the server, so a removal reaches both platforms at the same moment. If you use a third-party age check whose SDK ships only as native iOS and Android libraries, bridging it is native module work in both projects, and the camera access and data it handles belong in the same risk assessment as everything else. The assessments are your record to keep, and they are cheaper to write while the content features are being designed than after launch. How the duties fall on your service is for your own counsel.

Two strands of UK policy govern the stores themselves. The government's Code of practice for app store operators and app developers, voluntary and last updated in October 2023, asks every developer to keep a vulnerability disclosure process, ship fixes for security vulnerabilities, update the app when a third-party library or SDK it uses receives a security or privacy update, request no permissions the app does not functionally need, keep the primary function working when optional permissions are refused, and give users a way to request deletion of their personal data. Cross-platform apps make two of those harder than they look. A native SDK usually reaches a Flutter or React Native app through a wrapper plugin, so a security release from the SDK vendor does not arrive until someone bumps the plugin, and where the wrapper lags we pin the native version ourselves in Gradle or CocoaPods rather than wait. And over-the-air updates through EAS Update or Shorebird carry JavaScript or Dart only, so a native fix still needs a store build and review, which is a reason to keep the release pipeline ready rather than lean on hot patches. The second strand is competition law. The CMA designated Apple and Google with strategic market status in mobile platforms on 22 October 2025, and on 1 April 2026 published final commitments from both on reviewing and ranking apps in a fair, objective and transparent way and on not using developers' data unfairly, with Apple also committing to consider requests for interoperable access to iOS features fairly. That gives a UK developer a route to ask for a platform capability a cross-platform plugin cannot reach today. The CMA consulted on a steering conduct requirement for each company on 30 June 2026 and published the responses on 14 August 2026, and neither case page showed a decision by the end of September, so a UK purchase flow that links out is best kept behind a storefront flag. Your obligations under each are for your own counsel.

How we work with UK clients

UK engagements tend to start with procurement questions rather than technical ones. Who holds the data, which law governs the contract, whether you can produce a record of processing if the ICO asks. We answer those in the proposal instead of leaving them to a legal review three weeks in, because that review is where UK projects usually stall.

Invoicing is the other thing worth settling early. We are outside the UK, so services we supply generally fall under the reverse charge and your finance team accounts for the VAT rather than paying it to us. Our invoices say so explicitly. We quote in pounds, the figure does not move with the exchange rate mid-project, and payment by bank transfer avoids the card fees that make a five-figure invoice unnecessarily expensive.

Indicative pricing in GBP

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions UK clients ask

Flutter & React Native Apps: common questions

Other markets we work in