If I'm transferring a domain with privacy protection to AleForge, do I need it turn privacy protection off to transfer?

Yes, if the privacy protection service is enabled at your previous registrar this service must be disabled so that you can respond to transfer confirmation emails.