Currently the iOS and Node (and Android?) SDKs will issue an advance request to the server -- for each ACL the user has read access to -- at least every 5 seconds.
The SDKs should implement an intelligent backoff strategy for advance requests that incorporate events such as app connect/disconnect and app foreground/background to reduce advance traffic so as to differentiate from polling.