Flutter & React Native Apps in the US

About Flutter & React Native Apps

Our React Native and Flutter development services take a cross-platform iOS and Android app from first screen to store release. We use Flutter when polish and 60fps animations matter, and React Native when speed-to-market and shared code with the web matter more. From MVP launches to enterprise apps with 100k+ users, we handle the full lifecycle: design, native module integration, App Store and Play Store submission, push notifications, analytics, and ongoing version updates.

What the engagement includes

• Flutter app development (iOS + Android)
• React Native app development (iOS + Android)
• Native module development for platform-specific features
• Push notifications (FCM, APNS, OneSignal, Firebase)
• In-app purchases and subscription billing (RevenueCat, native IAP)
• Real-time features via WebSockets or Firebase
• Offline-first apps with sync (SQLite, WatermelonDB, Realm)
• Maps and location services (Google Maps, Apple Maps, Mapbox)

Precise location, medical device updates and the 48-hour takedown in a US cross-platform app

In a Flutter or React Native app the location permission is set in native configuration, not in the Dart or JavaScript a reviewer reads, and several US states now make the line between precise and approximate location a legal one. Maryland's Online Data Privacy Act took effect on 1 October 2025 and applies to processing from 1 April 2026. It treats precise geolocation as sensitive data, forbids collecting sensitive data beyond what is strictly necessary to provide the product or service the consumer asked for, and bans selling it even with consent. Oregon has banned the sale of precise geolocation since 1 January 2026, and Oregon's statute draws the line at locating a person or device within a radius of 1,750 feet. Washington's My Health My Data Act makes it unlawful to place a geofence of 2,000 feet or less around a facility providing in-person health care in order to track people seeking care, collect their health data or send them messages about it, and a violation is an unfair or deceptive act under the state's Consumer Protection Act. Android's documentation puts approximate location at roughly three square kilometers and precise location usually within about 50 meters, so an app that needs only a city or a delivery zone can request ACCESS_COARSE_LOCATION alone and never hold a coordinate that fine. The trap is in how a cross-platform build is assembled. Gradle merges the Android manifest of every plugin and SDK into the app's own, so a location plugin or an attribution SDK can bring precise or background location into the shipped binary without anyone on the team writing it. We read the merged manifest and the iOS Info.plist on each release, remove what the product does not use, and keep location behind one service in the codebase, so whether the app collects precise location is a fact about the build rather than a recollection. Whether these thresholds reach your business is for your own counsel.

If the app is a medical device in FDA's terms, the update channel that makes cross-platform development attractive is the part that needs the most care. React Native apps can take new JavaScript over the air through services such as EAS Update, and Flutter apps can take Dart patches through Shorebird; neither can ship native code, and Microsoft's CodePush went with App Center when that service was retired on 31 March 2025, so an older React Native app that relied on it needs a replacement. For a regulated app every patch is a change to a device. Since 2 February 2026 the Quality Management System Regulation has incorporated ISO 13485, so an over-the-air patch passes through the same design controls and records as a store release and sits in the same version history, and a patch that reaches phones before its own verification is the failure to design out. A device whose software can connect to the internet is a cyber device under section 524B of the Food, Drug, and Cosmetic Act, which requires a plan to monitor and address postmarket vulnerabilities, updates and patches on a reasonably justified regular cycle with critical ones out of cycle, and a software bill of materials. FDA's cybersecurity guidance of 3 February 2026 asks, for every component in that bill, its level of support, whether actively maintained, no longer maintained or abandoned, and its end-of-support date, and recommends that updates be cryptographically authenticated so an unauthorized version or a rollback cannot install. A cross-platform app carries three dependency trees: the pub or npm packages, the CocoaPods or Swift packages beneath them, and the Gradle libraries. Community plugins are where an unmaintained package most often hides, so the bill is generated from all three on every build, plugin choice weighs who maintains the package, and the update channel verifies a signature before it runs anything. Whether your app is a device at all is for your regulatory counsel.

If users can post images or video to each other, the TAKE IT DOWN Act, Public Law 119-12, has put a federal removal clock on the app since 19 May 2026, one year after it was signed. A covered platform, which the Act defines to include a mobile application that serves the public and primarily provides a forum for user-generated content, must give clear and conspicuous notice in plain language of a process through which an identifiable individual, or someone authorized to act for them, can ask for a nonconsensual intimate image to be removed, whether real or digitally created. It must remove the image within 48 hours of a valid request and make reasonable efforts to identify and remove known identical copies, and a failure to comply is treated as an unfair or deceptive practice that the FTC enforces. A valid request is in writing and carries a physical or electronic signature, enough information to locate the image, a brief statement of a good faith belief that it is not consensual, and contact details. So the in-app report is a form built to collect exactly those four things, reachable by the person depicted even if they have no account, and stamped with the time it arrived, because that time starts the clock. Two things are specific to how mobile apps hold media. Image caching libraries keep copies on the phone, so a removal has to invalidate the cached copies and the CDN edge as well as the database row, or the image stays on the screens of everyone who has already scrolled past it. And known identical copies are found by hashing media at upload, which costs little when the media pipeline is first written and a great deal to backfill across a library of existing posts. The Act protects good faith removals from liability, which supports an admin action that takes content down first and reviews it afterwards. Whether your app is a covered platform is for your own counsel.

How we work with US clients

A US engagement gets agreed twice. Once with the person who wants the thing built, and then again with legal, security, procurement and finance, who arrive separately and rarely in the same week. That second round is where a supplier outside the country loses the calendar: a master services agreement to redline, a security questionnaire, a certificate of insurance, and a vendor portal that assumes everyone it onboards can sign a W-9. Send all of it while the scope is still being written rather than in the week you wanted to start, and where the honest answer to a row is that we do not hold something, we write that in rather than leaving it blank.

You are also buying from a company you cannot drop in on, so the evidence has to do the work an office would otherwise do. What we send is live production URLs rather than a deck, a written scope with one fixed number against it, and the names of the people who will do the work rather than a bench that changes after signature. What we will also tell you is the shape of what you are hiring: a small team in Noida that has been building since 2021, not a firm that can put four more people on your project next Monday. If that is what your timeline needs, we say so before the contract rather than after it.

Indicative pricing in USD

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions US clients ask

Flutter & React Native Apps: common questions

Other markets we work in