Once someone has gotten unsupervised, hands-on access to anything like a mobile device or a computer, it's pretty much game-over. No there is no easy way to determine what might have been done. This sounds reactionary and scary but it's just an obvious factual matter.
Depending on the skill level of this a-hole, it could be just amateurish nonsense he implemented, or something more insidious. The point being a really good, well-crafted exploit is by design going to be hard to detect (there's no point having creating a really sophisticated hack if just anyone can see what it's doing) and hard to remove (often has multiple ways to reinstall itself when one is revealed). So taking your mobile devices to a local retail repair center 'might' find something but that's all very conditional on the skill level of the person looking into your devices and what may have actually been done.
Typically a more common occurrence of just some remote-code exploit infecting your devices can be defeated by a) backup anything you need saved off your devices, b) flashing an appropriate, stock ROM, c) doing a Factory Reset, and d) using multiple and reputed anti-virus/anti-malware utilities thoroughly scan that backup before restoring anything to your devices, e) while all the previous is being done, change the passwords to all yours online services (note that once then you'll need to re-authentic your logins with all those relative apps with your new passwords) But again, this is a more serious matter because someone had physical possession of your devices so that changes the situation significantly -- even if you cleanse your mobile devices, if one or both of them are connected to your home network, Mr. A-hole could have done something like also installed a worm on a local computer or any online storage (i.e. a NAS) so the infecting cycle could just be repeated. That's just a hypothetical but still reality so whatever the case you do have serious issues to take care of. This guy really screwed you over as unless you can tie him down and beat the truth out of him, determining just what he did will be difficult.
https://www.us-cert.gov/ncas/tips/ST05-006
Going on from here be sure to set up a lock screen on your mobile devices (iris scan, fingerprint, password, or whatever) so people can't just pick up your stuff and manipulate them, and set up a WiFi guest network for whenever you have company over so they still have online access but none to your home networking.