Alora AI is a ten-week-old indie character-chat app on iOS, iPadOS, macOS, and visionOS. The product offers persistent character memory, custom character creation, swipe-style discovery, group chats with up to three characters, and recent image and video responses. Eleven versions have shipped in ten weeks. Early App Store ratings sit at 4.7 out of 5 across 43 ratings, and reviewers keep praising the memory features. The core experience is competently built.
The operator profile is a different story. Five different legal entities appear across the App Store seller line, the Terms of Use, the Privacy Policy, the privacy policy the Terms link to, and the iOS bundle identifier. The bundle ID com.rimaru.app confirms the app shipped under a different brand. The privacy policy the Terms officially links to still references a different company name throughout. Apple’s App Store privacy declaration claims “Data Not Collected” while the Privacy Policy itself enumerates extensive collection of personal data, device identifiers, and 24-month chat retention. And two of the ten visible App Store textual reviews appear to come from team members.
This review covers what Alora is and how it works. It covers the five-entity operator question and the Rimaru rebrand fallout. It covers the App Store privacy label mismatch, four contradictory age signals, 24-month chat retention with no opt-out, gem-economy pricing, fake-review concerns, and how the policy stack stacks up against alternatives. The product is real and growing. The infrastructure around it hasn’t caught up.
What Is Alora AI and How Does It Work?
Alora is distributed through Apple’s App Store as “Alora: AI Character Chat”, App Store ID 6759547124, bundle ID com.rimaru.app. The first public version went live March 5, 2026. The current version is 1.1.0, the eleventh build in roughly ten weeks. The app weighs 62.8 MB and supports iOS 15.1+, iPadOS 15.1+, macOS 12.0+ on M1 Macs, and visionOS 1.0+. English is the only language. No Google Play listing exists.
The core product is character chat with persistent memory. The App Store update notes record the feature path. Swipe discovery shipped in v1.0.5 on March 17. Group chats of up to three characters shipped in v1.0.6 on March 24. Auto-generated replies and a referral program shipped in v1.0.7 on March 29. Character image replies and “permanent memory” shipped in v1.0.8 on April 1. In-chat video creation shipped in v1.0.9 on April 14. v1.1.0 on May 14 added “better chat interactions, videos, and images.”
Monetization mixes subscriptions and consumable gem packs. The basic tier runs $9.99 weekly, $14.99 monthly, or $79.99 annual. The Platinum tier runs $12.99 weekly, $19.99 monthly, or $99.99 annual. Gem packs range from $1.99 (500 gems) to $99.99 (40,000 gems). An archived earlier listing shows lower launch pricing ($9.99 monthly, $2.99 for 500 gems), so prices have been raised since March.
App Store reviewers consistently praise the memory features. Of the ten textual reviews fetched from the iOS RSS feed, five mention persistent memory and three praise custom character creation. Negative feedback centers on the gem economy, with two reviewers flagging an $8 paywall for unlimited chat as the primary friction point.
Who Operates Alora AI?
This is where the review gets unusual. Five different legal entities appear across the public surfaces of the same product.
- App Store seller: “David Wang,” artist ID 1871405478. The copyright line reads “© Alora Inc” with no corporate suffix.
- Terms of Use: “Alora Technologies, Inc.,” a Delaware corporation with principal place of business in San Francisco. Contact: hunter.william.su@gmail.com (a personal Gmail).
- Privacy Policy: “Alora” with country listed as “California, United States.” Contact: davidwang1089@gmail.com (a second personal Gmail).
- TermsFeed-hosted Privacy Policy: “Rimaru” throughout the policy text. This is the URL the Terms of Use Section 8 directly links to.
- iOS bundle identifier:
com.rimaru.app. Permanent technical identifier set at first submission, confirming the app shipped under “Rimaru” and was later rebranded.
Two unrelated personal Gmail addresses, no corporate domain, free Google Sites pages, and a privacy policy that the Terms link to that uses the wrong company name. This is the legal and operator surface a user encounters before installing the app.
The simplest reading: a developer built a character-chat app, shipped it under “Rimaru,” then renamed it to “Alora” before or shortly after the first public release. The App Store seller line got updated. A new Terms of Use was drafted under a new corporate name. A new Privacy Policy was hosted at sites.google.com/view/aloraai/privacy. But Section 8 of the Terms still links to a TermsFeed policy URL drafted for “Rimaru” that was never updated. Click that link, and you get a contract written for a different company name.
Free Google Sites hosting, two personal Gmail addresses, no corporate domain, and a linked policy that names the wrong entity is below the documentation baseline most companion apps publish.
Citation capsule on operator identity and the Rimaru rebrand: Five legal entity names appear across Alora AI’s public surfaces. The App Store seller line lists “David Wang” with a “© Alora Inc” copyright. The Terms of Use, on a free Google Sites page at sites.google.com/view/aloraai, names “Alora Technologies, Inc.” as a Delaware corporation and lists hunter.william.su@gmail.com as support. The Privacy Policy at sites.google.com/view/aloraai/privacy names “Alora” with a different personal Gmail, davidwang1089@gmail.com. The Terms of Use Section 8 links to a TermsFeed-hosted Privacy Policy URL whose text still references “Rimaru” throughout, a copy-paste artifact from a prior brand. The iOS bundle identifier com.rimaru.app corroborates the pre-rebrand origin and is a permanent technical identifier set at first submission. No corporate domain operates. Source: App Store listing ID 6759547124, sites.google.com/view/aloraai Terms of Use, sites.google.com/view/aloraai/privacy Privacy Policy, and the linked TermsFeed Privacy Policy.
Why Does the App Store Privacy Label Say “Data Not Collected”?
Apple requires every developer to submit a privacy declaration at app review that describes what data the app collects, what data is shared, and what data is used for tracking. Alora’s submission to Apple states: “Data Not Collected. The developer does not collect any data from this app.”
The developer’s own Privacy Policy, hosted at sites.google.com/view/aloraai/privacy, lists the categories of personal data collected directly. The policy specifies email address and first and last name as personal data collected. It specifies IP address, browser type and version, pages visited, time and date of visits, time spent on pages, unique device identifiers, mobile device type, mobile device unique ID, mobile operating system, mobile internet browser, and diagnostic data as usage data collected. The policy also specifies that chat transcripts are retained up to 24 months for “quality assurance and staff training purposes.”
The two statements don’t reconcile. An account-based app with email registration, subscription billing, persistent chat memory, device-level analytics, and 24-month transcript retention isn’t an app that “does not collect any data.” One of the two disclosures is materially incorrect, and the more detailed Privacy Policy is the more credible.
The App Store Review Guidelines Section 5.1.2 (Data Use and Sharing) requires developer privacy submissions to accurately reflect the app’s data collection practices. A “Data Not Collected” submission paired with a Privacy Policy that enumerates extensive collection is the configuration that triggers rejection when challenged. Apple has not acted publicly against this app, but the mismatch sits inside the platform’s stated policy.
What Are the Four Different Age Signals?
Age policy across Alora’s public surfaces is contradictory in a way that’s unusual even for indie apps.
- Terms of Use: “You must be at least 13 years old to use the Service. If you are under 18, you represent that you have permission from a parent or legal guardian.”
- Privacy Policy: “Our Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16.”
- iTunes Lookup API: Content advisory rating returned as 17+.
- App Store HTML page: Content advisory rating displayed as 18+.
Four documents, four different age floors, no documented verification mechanism beyond user self-reporting on a landing prompt. The App Store self-declared categories include “Infrequent Cartoon or Fantasy Violence,” “Profanity or Crude Humor,” and “Guns or Other Weapons,” and the listing carries “User-Generated Content” and “Advertising” labels. The Terms of Use admits users as young as 13 with parental permission to a platform Apple rates 17+ to 18+ for mature content.
For a companion app where 13-year-olds can create accounts under the Terms but the App Store positions the product as 17+ or 18+, the age policy gap is large. No documented verification flow exists to close it. There’s no parental-control documentation, no time-limit documentation, and no minor-specific safeguard mentioned anywhere in the policy stack.
How Long Does Alora Keep Chat Transcripts?
The Privacy Policy specifies that chat transcripts are retained “up to 24 months for quality assurance and staff training purposes.” Account information is retained for the duration of the relationship plus up to 24 months after closure. Support tickets are kept up to 24 months from ticket close. Usage data is retained up to 24 months. Indefinite retention is permitted for legal obligations, legal claims, backups, and anonymized analytics.
Three details are worth surfacing. First, the stated purpose of the 24-month chat retention is “quality assurance and staff training,” which the policy does not further define. There is no commitment that chat transcripts are excluded from human review, no commitment that conversations are end-to-end encrypted, and no statement on whether chat content trains the AI model. The Terms of Use license grant for “operating and improving the Service” is broad enough to cover training without naming it.
Second, the deletion right is soft. The policy says “You have the right to delete or request that We assist in deleting” personal data, but adds “We may need to retain certain information when we have a legal obligation or lawful basis.” No service level agreement is specified, no confirmation mechanism is described, and no full-erasure guarantee is offered.
Third, no data-portability mechanism exists. GDPR Article 20 portability, CCPA right-to-know-and-receive, and any other user-facing export workflow are absent. A user who wants a copy of their chat transcripts cannot get one through any documented path.
Citation capsule on chat retention, training-data risk, and deletion rights: The Privacy Policy at sites.google.com/view/aloraai/privacy retains chat transcripts “up to 24 months for quality assurance and staff training purposes,” with no opt-out and no commitment that transcripts are excluded from human review. Account information and usage data are also retained up to 24 months, and indefinite retention is permitted for legal obligations, claims, backups, and anonymized analytics. The Privacy Policy is silent on whether chat content trains the AI model, and the Terms of Use grant a “worldwide, non-exclusive, royalty-free, sublicensable, transferable license” to use content “in connection with operating and improving the Service,” language broad enough to cover training without naming it. The deletion right exists in principle but has no service level agreement and is qualified by “We may need to retain certain information when we have a legal obligation or lawful basis.” No data export mechanism is documented. Source: sites.google.com/view/aloraai/privacy Privacy Policy and Terms of Use, both dated February 24, 2026.
How Trustworthy Are the App Store Reviews?
The visible 4.7-of-5 rating is built on 43 total ratings, ten of which carry text reviews fetched through the iOS RSS feed. Two of those ten reviews look like they came from team members.
The first 5-star launch-day review (March 7, 2026) was posted by “huntersu4.” The Terms of Use lists “hunter.william.su@gmail.com” as support; the username prefix matches the email. The second 5-star launch-day review was posted by “nick_sherwood,” a name that matches the operator’s internal cw_app registry attribution. Both reviews landed within 48 hours of the first public version.
If those two reviews are excluded, the remaining eight average 4.50 of 5. The pair represents roughly 5 percent of the 43-rating sample, so the headline rating is not the primary concern. The concern is what the practice reflects about review hygiene, which lines up with the other transparency gaps in the policy stack.
None of the ten textual reviews discuss safety, age-appropriateness, harassment, harmful content, or moderation. Negative feedback is exclusively about the gem economy and a single signup database error. Absence of negative safety signal in a ten-review, ten-week sample is not strong positive evidence.
What Crisis Response and Safety Documentation Exist?
Nothing exists. The Google Sites domain hosting Alora’s legal documents has three pages: the Terms of Use, the Privacy Policy, and a Support page. No safety page. No trust page. No transparency report. No content moderation policy. No published crisis-response protocol. No suicide-prevention referral. No in-app report-content flow. No appeals process for content flags or account terminations. The Support page directs users to a personal Gmail address and to a Discord server (discord.gg/vAKgu5Ztmh) that the developer’s review-response history shows is used primarily for free-gem promotion.
For a character-chat app where users build long-running relationships with characters that have persistent memory, the absence of any documented crisis-response protocol is a category gap. Mainstream alternatives publish, at minimum, an explicit content-moderation policy and a stated suicide-prevention or self-harm referral. The Federal Trade Commission’s September 2025 6(b) inquiry into AI chatbot companions and their impact on minors named seven companies. Alora wasn’t named, but the category-wide regulatory posture matters for any new entrant, and “no crisis-response documentation” is the configuration that draws regulatory attention.
What Does the Subscription Contract Actually Commit You To?
The Terms of Use are notable for what they don’t contain. No mandatory arbitration clause. No class-action waiver. Disputes are routed to state or federal courts in San Francisco County, California under California law. That’s a more user-friendly forum-selection clause than the arbitration-and-class-waiver default most companion apps use.
The other contract terms are less favorable. Subscriptions auto-renew unless canceled at least 24 hours before the end of the billing period. Fees are non-refundable except where law requires. Liability is capped at the greater of $100 or amounts paid in the past 12 months. The developer reserves the right to suspend or terminate accounts “with or without notice.” No appeal mechanism. No minimum notice period. No pre-termination data-export window.
The content license, covered above, is broad enough to cover internal training and to be sublicensed to third parties. Users retain ownership of their content but grant Alora a worldwide, royalty-free, sublicensable, transferable right to use it.
How Does Alora Compare to Mainstream Alternatives?
The closest mainstream alternatives differ from Alora primarily on operator documentation rather than feature set. Three options cover most readers.
- Character.AI is the dominant character-chat platform with a named operator, larger character library, polished moderation policy, and explicit content-tier separation. Available on iOS, Android, and the web.
- Replika is operated by Luka Inc. with 10M+ Play Store installs. It defaults to a PG-mode companion and publishes more detailed safety and crisis-response documentation than Alora.
- Talkie AI is a mainstream character app on both iOS and Android with a Privacy Policy on a corporate domain and a named operator. Closer feature match to Alora’s positioning than Replika.
The case for picking Alora is narrow. If a reader is iOS-only, comfortable with an indie product, wants persistent memory plus rapid iteration, and treats the policy stack as informal, Alora is a coherent choice. For users who want a consistent age policy, an accurate App Store privacy label, a named operator on a corporate domain, documented crisis-response, or a chat-export path, the alternatives win.
Who Should Use Alora AI?
Casual character-chat users on iOS who value persistent memory and recent feature additions (group chats, image responses, in-chat video), and who are comfortable adopting an indie ten-week-old app from an operator with five different entity names and free Google Sites legal pages, are the natural fit. The 4.7-of-5 visible rating is real for the eight independent-looking reviewers.
Users who should pick a different platform include anyone who needs a consistent age policy. Anyone who wants the App Store privacy declaration to match the Privacy Policy. Anyone who would rely on documented crisis response. Anyone who wants chat-transcript export. Anyone who would not accept 24-month chat retention with no opt-out for an undefined “quality assurance and staff training” purpose.
Frequently Asked Questions
Is Alora AI safe to use?
Alora earns an F safety rating (22/100, Red tier) in the CompanionWise 23-dimension safety review. According to the Privacy Policy at sites.google.com/view/aloraai/privacy, chat transcripts are retained up to 24 months with no opt-out. The App Store privacy declaration contradicts the Privacy Policy, and operator identity is inconsistent across five documents.
Why does the App Store say Alora collects no data?
The developer’s submission to Apple states “Data Not Collected,” but the Privacy Policy at sites.google.com/view/aloraai/privacy enumerates email, name, IP address, device identifiers, usage data, and 24-month chat transcript retention. According to App Store Review Guideline 5.1.2, privacy submissions must accurately reflect collection practices, so the two declarations are not reconcilable.
Why are there five different company names for Alora?
The Apple App Store lists “David Wang” with a “© Alora Inc” copyright. The Terms of Use names “Alora Technologies, Inc.” The Privacy Policy names “Alora.” A linked TermsFeed policy still references “Rimaru.” The bundle ID is com.rimaru.app. According to the Terms of Use and Privacy Policy at sites.google.com/view/aloraai, the operator infrastructure was not fully migrated after a rebrand.
How old does Alora say I need to be?
Four different documents give four different age floors. According to the Terms of Use, users must be at least 13. The Privacy Policy says 16. The iTunes Lookup API returns 17+. The Apple App Store HTML page displays 18+. No verification mechanism beyond a self-reported landing prompt is documented in the policy stack.
Does Alora train AI on my chats?
The Privacy Policy does not address AI training. According to the Terms of Use at sites.google.com/view/aloraai, users grant Alora a “worldwide, non-exclusive, royalty-free, sublicensable, transferable license” to use content “in connection with operating and improving the Service.” That language is broad enough to cover training without naming it. No opt-out is documented.
Can I export my chat transcripts from Alora?
No documented export path exists. According to the Privacy Policy at sites.google.com/view/aloraai/privacy, the policy enumerates a deletion right (“You have the right to delete or request that We assist in deleting”) but does not mention data export, GDPR Article 20 portability, CCPA right-to-know-and-receive, or any user-facing download mechanism for chat history or account data.