Using Dex2Jar and JD-GUI, one can easily obtain the source code to your Android application. Dex2Jar will convert the APK into a Jar file and JD-GUI will read any classes and files in it.
Links to the software here:
My recommendation to you is obfuscate your code. It will certainly give malicious users a tough time.
Unfortunately, I don’t have any advice on iOS since I don’t know how native apps operate.
I hope this helps you.