We'll keep this as human as legal text allows. Last updated June 2026.
Last updated: June 20, 2026
Alora is a daily planning app for ADHD and AuDHD adults, operated by Spectrum Shift LLC, doing business as Alora ("we," "us," "our"). This Privacy Policy explains how we collect, use, and protect your personal information when you use Alora and our related services. We are committed to transparency about our data practices and your privacy rights.
Our promise: We never sell your data. Never have, never will.
This policy applies to all products and services provided by Spectrum Shift LLC, including our website at aloraplanner.com, our applications, and any related services (collectively, the "Services").
Alora is a productivity and planning tool, not a medical device, clinical service, or mental health application. The Services do not diagnose, treat, cure, prevent, or manage attention deficit hyperactivity disorder (ADHD), autism spectrum disorder (AuDHD), or any other medical or mental health condition.
Do not enter protected health information into the Services. Alora is not a HIPAA-covered entity. Do not enter clinical diagnoses, medication names and dosages, therapy notes, or other protected health information (PHI). If you do enter health-related information, we treat it as ordinary personal information under this Privacy Policy; we do not provide HIPAA-compliant safeguards for PHI.
AI-generated suggestions and content produced by the Services are for productivity support only and are not a form of therapy, clinical intervention, or emotional counseling.
We collect only the information necessary to provide and improve our Services. Here is what that includes.
Account information: When you create an account, we collect your email address and any other information you choose to provide during registration.
Profile information: You may choose to add profile details such as your display name, time zone, and preferences to personalize your experience.
Payment information: If you subscribe to a paid plan, our payment processor (Stripe, Apple, or Google) handles your payment details directly. We store only the information necessary for billing, such as your billing email address and the last four digits of your payment method, where applicable. We never see or store your full card number.
Content you create: This includes your brain dumps, tasks, blueprints, vision board items, morning briefs, evening reflections, and any other content you add to Alora. We access this information only to provide the Services you have requested.
Communications: When you contact our support team or communicate with us, we keep records of those interactions to help provide better service.
Usage data: We collect information about how you use Alora, including which features you access and how frequently, time spent in different areas of the app, user flows and navigation patterns through the Services, onboarding completion and feature adoption, and interaction patterns and engagement metrics.
Device and technical information: We collect information about the devices and technology you use, including device type, operating system, app version and build information, screen resolution, and device model.
Mobile application data: When you use the Alora mobile application, we collect device-specific information such as your push notification token (via Google Firebase, to deliver push notifications to your device), and app permissions you have granted (for example, microphone access if you use the voice transcription feature). We do not collect continuous location data.
Performance and reliability data: To ensure our Services work properly, we collect error messages, crash reports, and diagnostic information, including the error message and technical stack trace recorded when something fails in the app.
IP address: Our service providers receive your IP address as part of ordinary network requests. We use it for security purposes, such as detecting suspicious sign-in activity, and to comply with local laws where applicable.
Session and activity data: We collect information about your sessions, including session duration and frequency of use, features used and navigation flows, referral sources (how you found our website), time zone information, and login patterns and authentication events.
Email and communication tracking: When we send you emails, we collect whether you open our emails and when, which links you click in our communications, and email delivery status information. This applies to transactional emails and, where you have opted in, marketing emails.
Security and fraud prevention: For security purposes, we collect login attempts and authentication patterns, suspicious activity detection data, and security event logs and access patterns.
Testing and feature data: To improve our Services, we may collect data related to A/B testing participation, beta feature usage and feedback, and feature configuration data.
We want to be clear about what we do not collect:
We use your information to provide, improve, and protect our Services.
To provide our Services:
To improve our Services:
To provide AI-enhanced features:
To communicate with you:
To ensure security and compliance:
We process your information only when we have a lawful basis to do so. See the GDPR section below for a mapping of processing activities to lawful bases.
We do not sell your personal information. We do not rent it, license it, or share it with third parties for advertising, marketing profiling, or any commercial purpose outside the service providers listed below. We never have, and we never will.
We believe in data minimization. We do not sell your personal information and never will. Here is when we might share it.
We work with trusted third-party companies that help us provide our Services:
| Provider | Purpose | Data Location | International Transfer |
|---|---|---|---|
| Supabase Inc. | Stores account and content data; handles authentication | United States | Standard Contractual Clauses |
| OpenAI Inc. | AI language model services: Blueprint generation (GPT-5.5), voice transcription (Whisper-1) | United States | Standard Contractual Clauses |
| Anthropic PBC | AI language model services: Brain dump processing (Claude Sonnet 4-6) | United States | Standard Contractual Clauses |
| Stripe Inc. | Processes web subscription payments | United States | Standard Contractual Clauses |
| Apple Inc. | Processes iOS subscription payments under Apple's terms | United States | Apple's DPA |
| Google LLC | Processes Android subscription payments under Google's terms | United States | Google's DPA |
| Google Firebase | Delivers push notifications to your device | United States | Standard Contractual Clauses |
| Intuit Mailchimp | Sends opted-in email updates and newsletter | United States | Standard Contractual Clauses |
All service providers are contractually required to protect your information and use it only for the purposes we specify. We do not share your content with any third party for advertising, analytics, or any other commercial purpose.
We may share information in other circumstances when you have given us explicit permission to do so.
We may disclose information when required by law or when we believe in good faith that disclosure is necessary to comply with legal process or government requests, protect against fraud or other illegal activity, investigate security incidents, or protect the rights, property, or safety of Spectrum Shift LLC, our users, or others.
We are committed to protecting your data from unnecessary government access. If law enforcement approaches us, we require proper legal process (warrants, subpoenas, court orders) before sharing any data, we will notify affected users unless legally prohibited from doing so, and we will review all requests and may challenge those we believe are overly broad or improper. We have never received a National Security Letter or FISA order.
If Spectrum Shift LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
Alora includes AI-powered features designed to help you build Blueprints, process brain dumps, and transcribe voice input.
We never train AI models on your data. Not ours. Not third-party providers'. Not anyone's.
AI providers. Our AI features are powered in part by third-party AI services:
When you use AI features, your input is sent to the applicable provider to process your request and return a result. This is the only purpose for which your data is shared with these providers.
Data used for AI features:
Data storage and retention for AI: AI features process your data in real time. Data submitted to AI providers for processing is not retained by those providers beyond the time needed to generate the response, consistent with their data handling commitments and our data processing agreements with them. AI outputs you save within Alora are stored as part of your User Contributions and retained according to the Data Retention section below.
We do not train AI models on your data. Your content is never used by us or by our AI providers to train, fine-tune, or improve general AI models. Our agreements with AI providers contractually prohibit this use.
AI accuracy. AI-generated outputs may be inaccurate, incomplete, or unsuitable. You should verify AI suggestions before relying on them, particularly for planning, health, or other consequential decisions.
Your AI data rights: You can enable or disable AI features in your account settings. You can delete AI-generated content and insights at any time.
Alora may in the future integrate with third-party services to enhance your planning experience, such as calendar services, task management tools, or other productivity apps. Any future integration will require your explicit consent to connect. When you enable an integration, we access only the information necessary for the integration to work, we follow the principle of least privilege, and you can disconnect integrations at any time. Each integrated service has its own privacy policy. We encourage you to review those policies to understand how they handle your data. We will update this policy before making any new data types available to third-party integrations.
We use cookies and similar technologies to improve your experience on our website and in our web application.
Types of cookies we use:
Your cookie choices:
Disabling essential cookies will affect the functionality of the Services.
Do Not Track. We do not currently respond to "Do Not Track" signals sent by browsers, as there is no accepted industry standard for what action to take in response to such signals. We will reassess this position if a standard is adopted.
Security is fundamental to everything we do. We implement industry-standard safeguards to protect your information.
Technical safeguards:
Organizational safeguards:
Your role in security:
No system is 100% secure. While we implement strong protections, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.
In the event of a security incident that may affect your personal information, we will:
We cannot guarantee that a breach affecting a third-party service provider (such as Supabase, OpenAI, Anthropic, or others) will come to our attention immediately, but we will notify you as soon as we are made aware after receiving notice from the provider. For security incidents involving payment information, our payment processors (Stripe, Apple, Google) operate their own incident notification programs consistent with PCI DSS requirements, and we will relay any notices we receive from them.
We keep your information only as long as necessary.
Active accounts: While your account is active, we retain your information to provide the Services.
Inactive accounts: If you do not access your account for 24 consecutive months, we may delete your account and associated data after providing 30 days' notice to the email address on file. We consider an account inactive if there is no login or application activity within the 24-month period.
Account deletion: When you delete your account, we remove your personal information within 30 days. Some information may be retained in aggregated or de-identified form that cannot reasonably be linked to you, for analytics purposes. Legal or security requirements may require us to retain certain information longer (for example, payment records for tax compliance, or dispute records during the applicable limitation period).
Backups: Information may persist in our backup systems for up to 90 days after deletion, at which point it is purged from backups as well.
AI processing: Data submitted to AI providers for real-time processing is not retained by those providers beyond the time needed to generate the response, consistent with our data processing agreements. AI-generated content you save within the Services is retained as part of your User Contributions until you delete it or delete your account.
Support communications: Records of support interactions are retained for 24 months.
Request records: Records of data subject and privacy requests (for example, access, deletion, and portability requests) are retained for at least 24 months for compliance and audit purposes.
You can request deletion of your data at any time by contacting us at support@aloraplanner.com.
Spectrum Shift LLC is based in the United States, and our primary servers are located in the United States. If you are accessing our Services from outside the United States, including from the European Union, the United Kingdom, or any other jurisdiction, your information will be transferred to, stored in, and processed in the United States by us and by our service providers.
When we transfer personal data from the EU to the United States, we rely on EU Standard Contractual Clauses (SCCs) as approved by the European Commission under Decision 2021/914. For transfers of personal data from the United Kingdom, we rely on the UK International Data Transfer Addendum (UK IDTA) to the EU SCCs, as issued by the UK Information Commissioner's Office. We have entered into data processing agreements incorporating the applicable SCCs or UK IDTA with each of the service providers listed in our subprocessor table.
We have assessed the laws of the United States applicable to the processing activities described in this policy and considered the safeguards in place under our contractual arrangements. We are satisfied that, with those safeguards, transfers are consistent with the requirements of the applicable SCCs and the UK IDTA.
A copy of the applicable SCCs, UK IDTA, or confirmation that they are in place is available upon request by contacting support@aloraplanner.com.
Our service providers' locations and applicable transfer mechanisms are listed in the subprocessor table in the "With Service Providers" section above.
You have control over your personal information. We apply the same data rights to all customers, regardless of their location. Depending on where you live, you may have some or all of the following rights.
Access and portability:
Correction and deletion:
Control and restriction:
Do Not Sell or Share: Although we do not sell your personal information, if you wish to submit a "Do Not Sell or Share My Personal Information" request under applicable law, email us at support@aloraplanner.com with the subject line "Do Not Sell My Personal Information," including your name and account email address. We will add a web-based "Do Not Sell or Share My Personal Information" link to our website before our first date of data collection from California residents, as required by CCPA.
AI features:
You can manage many of these preferences directly in your account settings. For other requests, contact us at support@aloraplanner.com.
We will acknowledge data subject and privacy requests within 10 business days of receipt. We aim to respond to all privacy requests within 30 days. We may extend this period by an additional 60 days where reasonably necessary, in which case we will notify you of the extension. We may need to verify your identity before processing certain requests to protect your information. We do not retaliate or discriminate against you for exercising your privacy rights.
Under the California Privacy Rights Act (CPRA), "sensitive personal information" includes categories such as social security numbers, financial account credentials, precise geolocation, the contents of private communications, health data, biometric data, and certain other categories.
We do not intentionally collect sensitive personal information as defined under the CPRA, with the following limited exceptions:
We do not use sensitive personal information to infer characteristics about you, nor do we sell or share sensitive personal information for cross-context behavioral advertising. We do not use usage data, behavioral data, time-of-day patterns, or feature activity to infer health status, clinical diagnoses, or other protected characteristics about you.
Alora uses AI features to generate planning suggestions and content. These features analyze patterns within your account to make recommendations (for example, suggesting steps for a Blueprint based on your brain dump). This constitutes profiling in the sense that we process your data to generate suggestions tailored to you.
However, Alora AI features do not make automated decisions with legal or similarly significant effects on you. All planning decisions, task priorities, and scheduling choices remain yours. AI suggestions are recommendations for your consideration, not binding decisions.
You have the right to opt out of AI-generated profiling and suggestions at any time through your account settings. Opting out will disable AI features but will not affect your access to the non-AI features of the Services.
Alora is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are between 13 and 17, you must have your parent or guardian's permission to create an account and use Alora.
If we discover we have collected personal information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@aloraplanner.com.
Future versions of Alora may collect additional data types, such as calendar events and medication schedule timing. If medication timing data is collected in a future version, it will be timing data only (for example, reminder times), never linked to medication identity, dosage, diagnoses, or any other protected health information, and will not be disclosed to third parties for any commercial purpose. We will update this policy and notify you at least 30 days before collecting any new data types. Where applicable law requires consent for new data collection, we will obtain your explicit consent before collecting.
Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have specific rights regarding your personal information.
Categories collected (12-month lookback):
We do not sell your personal information and never have. We do not share your personal information with third parties for cross-context behavioral advertising. We may share information with service providers as described above for business purposes.
To submit a CCPA/CPRA request to access, delete, correct, or limit the use of your personal information, or to exercise your right to opt out of the sale or sharing of your personal information, contact us at support@aloraplanner.com with the subject line "California Privacy Request." You may also designate an authorized agent to make a request on your behalf. To use an authorized agent, the agent must provide either (a) a valid power of attorney, or (b) your written and signed permission authorizing the agent to submit the request, along with sufficient information to verify your identity. We may contact you directly to confirm your authorization before processing a request submitted by an agent.
Sensitive personal information. We do not collect or use sensitive personal information beyond the limited exceptions described in the Sensitive Personal Information section above. We do not use sensitive personal information to infer characteristics about you.
Non-discrimination. We will not discriminate against you for exercising your CCPA/CPRA rights.
Residents of Virginia (Virginia Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Connecticut Data Privacy Act), and Utah (Utah Consumer Privacy Act) have rights similar to those under the CCPA/CPRA, including rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of the processing of your personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.
To exercise any of these rights, contact us at support@aloraplanner.com with the subject line "State Privacy Request" and include your name, account email address, state of residence, and the right you wish to exercise. We will respond within the timeframe required by applicable law: 45 days for Virginia, Colorado, and Connecticut, with a 45-day extension (90 days total) where reasonably necessary; 45 days for Utah, with a 45-day extension (90 days total) where reasonably necessary. We will notify you of any extension within the initial 45-day period.
If we deny your request in whole or in part, you may appeal by contacting us at support@aloraplanner.com with the subject line "Privacy Request Appeal" within 30 days of receiving our denial. We will respond to an appeal within 60 days. If you are not satisfied with the outcome of your appeal, you may contact your state's attorney general.
We conduct data protection assessments for processing activities that present heightened risk, including AI profiling and processing of data that may be considered sensitive, as required by applicable state law (Virginia CDPA, Colorado CPA, Connecticut CTDPA).
We do not sell personal data or engage in targeted advertising as defined by these state laws.
Under the General Data Protection Regulation (GDPR) and UK GDPR, you have comprehensive rights regarding your personal data.
Lawful bases for processing:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and management | Contract performance (Art. 6(1)(b)) |
| Storing and syncing your content | Contract performance (Art. 6(1)(b)) |
| Processing payments and subscriptions | Contract performance (Art. 6(1)(b)) |
| Providing AI-assisted features | Contract performance (Art. 6(1)(b)) |
| Usage analytics and product improvement | Legitimate interests (Art. 6(1)(f)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Marketing email communications | Consent (Art. 6(1)(a)) |
| Legal compliance and enforcement | Legal obligation (Art. 6(1)(c)) |
Our legitimate interests in processing for analytics and security are to improve and protect the Services. We have assessed that these interests do not override your fundamental rights and freedoms, given the limited nature of data involved and the reasonable expectations of users of a subscription planning app.
International transfers. Personal data transferred from the EU or UK to the United States is protected by Standard Contractual Clauses. See the International Transfers section above for details.
Data Protection Officer. We have not appointed a Data Protection Officer, as we do not meet the thresholds requiring mandatory DPO appointment under Article 37 GDPR. Our designated privacy contact is available at support@aloraplanner.com.
Right to complain. If you are not satisfied with our response to a privacy request, you have the right to lodge a complaint with your local data protection authority. For EU residents, find your national supervisory authority at edpb.europa.eu. For UK residents, contact the Information Commissioner's Office at ico.org.uk.
We will notify you of material changes by email or in-app notice at least 30 days before they take effect. We will post the updated policy with a new "Last Updated" date. Continued use of our Services after changes take effect means you accept the updated policy.
We maintain a record of prior versions of this policy. To request a copy of a prior version, contact us at support@aloraplanner.com.
For disputes arising out of or relating to this Privacy Policy, the governing law and dispute resolution provisions in our Terms of Service apply.
For any privacy questions, concerns, or requests:
We aim to respond to all privacy inquiries within 5 business days.