Mobile App Development Company in Portland

Ranges tied to platform count and integration depth. A single-platform MVP with authentication, a core workflow, push notifications, analytics behind consent, and store submission typically runs USD 55,000 to 130,000 over three to five months. A production app on both iOS and Android with offline support, payments, deep integrations into a backend or ERP, and a real design system typically runs USD 130,000 to 350,000. A complex product with background location, Bluetooth peripheral support, HealthKit and Health Connect, high-concurrency launch mechanics, or HIPAA and financial-grade security requirements runs USD 350,000 to 900,000 and up. Cross-platform saves roughly 25 to 35 percent against building two native apps when the platform surface is modest, and saves nothing when it is not. Ongoing maintenance is typically 15 to 25 percent of build cost annually, and it is not optional: Apple and Google each ship a major OS release every year and both regularly change store policy on privacy disclosures. Portland engineering rates sit below San Francisco and modestly below Seattle. We quote fixed fee against a signed statement of work.

HB 2008 amended the Oregon Consumer Privacy Act and took effect January 1 2026. It prohibits the sale of precise geolocation information, defined around a radius of roughly 1,750 feet, subject to narrow communications and utility exceptions, and it prohibits processing the personal data of a consumer the controller knows or willfully disregards is under 16 for targeted advertising, sale or profiling. For a mobile team the practical exposure is not your own code, it is the SDKs. Many advertising, attribution and monetization SDKs monetize location data as part of their business model, and shipping one in an Oregon-facing app can place you on the wrong side of a sale prohibition without any decision anyone in your company consciously made. We audit every SDK in the build, read its data practices and contractual terms rather than its landing page, remove or replace any that traffic in precise location, and gate initialization of the remainder behind the user's consent state so nothing collects before a choice is made. We then reconcile the result against your App Store privacy label and Play Data safety form, because a mismatch there is its own problem.

The Oregon Consumer Privacy Act, SB 619, signed July 18 2023 and effective July 1 2024, classifies precise geolocation as sensitive data, which means opt-in consent before processing rather than notice plus an opt-out. Oregon's sensitive-data list is broader than most states and also covers health condition, genetic and biometric data, national origin, immigration status and status as transgender or nonbinary, which matters for onboarding forms and profile fields as much as for location. In an app this means the OS permission prompt is not sufficient on its own as a consent record. We build an explicit in-app consent step with a plain-language purpose statement shown before the system prompt, store the consent decision with a timestamp and the version of the notice that was displayed, and make it revocable from a settings screen that actually stops collection rather than hiding the toggle. Since January 1 2026 the OCPA also requires honoring universal opt-out mechanisms, so any companion web surface must read Global Privacy Control and, where identity links, that choice should propagate to the app account.

Assume the network is absent, not slow, because that is the actual condition thirty minutes past the trailhead. The local database is the source of truth for the UI: Room on Android, SwiftData or Core Data on iOS, WatermelonDB or SQLite for React Native. Every user action writes locally first and enqueues a mutation with a stable client-generated identifier so retries are idempotent. Sync runs as a background job with exponential backoff, resumes on connectivity change, and handles conflicts with an explicit policy rather than last-write-wins, which quietly destroys data. Map and route data is cached in advance with a clear download step and a visible storage cost, because users on a limited plan should choose. Media uploads are chunked and resumable. The UI never blocks on the network and never shows an indefinite spinner; it shows the local state plus a sync indicator. We test this properly in the device lab with airplane mode, forced 2G, mid-sync process termination and clock skew, because those are the scenarios that produce the crash reports you get in week three, not the happy path.

A signed business associate agreement with every vendor in the chain, starting with your cloud provider and including analytics, crash reporting and push infrastructure if PHI can reach them, which is why we keep PHI out of crash payloads and event properties by design rather than by policy. On device: no PHI in unencrypted local storage, Keychain or Android Keystore for credentials and tokens, biometric authentication with a passcode fallback, automatic session timeout, screenshot and screen-recording protection on sensitive views, jailbreak and root detection, and certificate pinning. In transit and at rest: TLS 1.2 or higher and encryption with documented key management. Health systems here, meaning OHSU, Providence, Legacy Health, Kaiser Permanente Northwest and OCHIN member clinics, run vendor security review before a pilot and generally expect SSO through their identity provider, an accessibility conformance statement and a completed security questionnaire. Integration is usually FHIR against Epic or Cerner rather than a custom API. HB 2748, effective January 1 2026, bars nonhuman entities from using nursing titles, so any in-app assistant needs its presentation reviewed.

Store rejection is nearly always a documentation problem rather than a code problem, so we prepare for it. Apple's privacy nutrition labels and Google Play's Data safety form both require an accurate account of what every SDK collects, whether it is linked to identity and whether it is used for tracking, so we maintain the SDK inventory as a living artifact through the build and generate the declarations from it rather than filling them in the night before submission. Apps that request location must justify the precision level and background use in the submission notes, and requesting always-on location without a demonstrable feature is a common rejection. Apple's App Tracking Transparency prompt is required before any tracking identifier is used, and its wording matters. Release goes out through Fastlane with staged rollout: one percent of Android users first, phased release on iOS, crash-free session rate and key funnel metrics watched daily, and a remote configuration flag that can disable a new feature without a store submission. That kill path is the single most valuable thing to build before launch rather than after.