This is due to the basic security restrictions in browsers.
With JSON you can only use the "only phone home" principle.
If your JSON service is e.g. http://mysite.com/customers then your mobile app must be on the same domain e.g. http://mysite.com/mymobileapp/index.html.
See Additional notes