0. Networking prerequisites

Every public endpoint is HTTPS with a valid certificate, so no App Transport Security exception and no cleartextTrafficPermitted config are needed. If an older build of your app still carries either, remove it — shipping a cleartext exception you do not need is a finding waiting to happen in app review. Two things to get right instead:
1

Read the base URLs from config

The hostnames encode the server IP (54-237-170-237.sslip.io). Keep them in an environment/remote-config file so an infrastructure move does not require a new release — see Network status.
2

Give chain calls their own client

Do not route chain traffic through the client that carries your product’s auth token. A 401 handler that force-signs-out has no business firing because a blockchain node was slow. Use a separate fetch wrapper with its own timeout (12s is what the reference app uses).

1. Register the device on launch

2. Heartbeat loop

Every 30–60s while the app is foreground + online:

3. Submit engagement on user action

4. Render profile + leaderboard

Poll every 5–10 seconds while the relevant UI is visible:

5. Production checklist (before mainnet)