I'd suggest you should nail down precisely what your developer is talking about. Neither XML nor hard coding are things I'd ever expect to hear in the context of "It's secure because I'm using X".
XML is a markup language. You're probably familiar with it's cousin, HTML? XML is used to transport and store data in a text file. Play about with mysql --xml and you should be able to dump a table as an XML file: that'll give you the idea better than any explanation I could give.
If you have an app that talks to a web service, and it sounds like you do, then XML is a popular choice for transmitting the data, but there's nothing secure about it. To do secure XML data transfer over the Internet, you have to layer some security on top of it:
- you might encrypt the data before putting it in the XML
- or (probably better) encrypt the XML file before transfering it
- or tunnel a secure channel over the Internet (e.g. SL or a VPN) to transmit the XML file.
Since you've already got SSL in place for your web surfing, adding it to your web service should be straightforward and this is probably the way to go. Hard to tell without more detail.
Next, "hard coded". This means data or configuration settings that is included in the source code of an application. It's usually a bad idea.
Key to understanding this is to know what he proposes to hard code. He can't mean the note data you are transferring - he doesn't have that at compile time because the user types it in. Is he maybe hard coding authentication data into the app? That feels wrong as well, surely you're doing per-user authentication. Maybe he's encrypting, and hard coding the key? All sorts of things wrong with that.
This would generally make me nervous. There are some situations where hard-coding is appropriate but generally it's a sign you're doing something terribly wrong.