Privacy Policy

Ultra Far Consulting, LLC, doing business as Jurat (“Jurat,” “we,” “us,” or “our”), provides law enforcement digital field intake, electronic sworn statement, and document workflow software. This Privacy Policy describes how we handle Personally Identifiable Information (PII) and Criminal Justice Information (CJI) collected through our platform (https://gfr-gfz-public.myjurat.com) and related services on behalf of subscribing law enforcement agencies.

We process information strictly on behalf of and under the direction of law enforcement agencies (“Agencies”):

• Affiant & Citizen Information: Name, date of birth, contact details (mobile phone number, email address), physical address, driver's license/ID information, and statement narratives provided during official field interactions.
• Officer & Agency Information: Name, badge number, official agency email address, and authentication credentials through Microsoft Entra ID.
• Audit & Metadata: Timestamps, IP addresses, digital signatures, identity verification methods, and system interaction logs required for evidentiary chain of custody.

Information collected is processed solely for official criminal justice and public safety administrative purposes, including:

• Delivering secure, time-limited one-time access links via SMS and email to affiants, victims, and witnesses.
• Generating tamper-evident, cryptographically signed sworn statements and evidentiary records.
• Facilitating case exports, discovery compliance, and official records retention.

Jurat maintains technical, physical, and administrative safeguards designed to meet the requirements of the FBI CJIS Security Policy, state privacy statutes, and NIST SP 800-53 standards:

• Encryption for data in transit (TLS 1.3) and at rest (AES-256).
• Cryptographic sealing and timestamping of finalized documents via Azure Key Vault-backed digital certificates.
• Single-tenant, per-agency deployment isolation and immutable audit logging.

The Jurat mobile app is a secure shell around the same platform described above. It adds no separate account, no separate database, and no analytics or advertising software of any kind. What it does add is a small number of on-device protections and the device permissions those require:

• Camera: used to photograph or scan a driver's license barcode and to capture ID or selfie images for victim packets. Barcode decoding happens on the device; the image is not uploaded for decoding. A resulting photo is transmitted only when the user submits it as part of a statement or packet.
• Photo library: used only to attach an image the user explicitly chooses, and to save an image back when the user asks for it. The app does not read, index or scan the library.
• Face ID, Touch ID or device passcode: used to re-confirm the person holding the device before screens containing criminal justice information are shown, on launch and after the app has been in the background. Biometric data never leaves the device and is never available to Jurat — the operating system answers only yes or no.
• Device integrity: the app checks whether the device has been rooted or jailbroken and refuses to run if so. This check is local and reports nothing.

The app also blocks screenshots and screen recording of screens that can contain criminal justice information, covers its own contents in the app switcher, and stores only one preference locally: the agency URL it was configured to connect to.

Some agencies offer a public online reporting site on their Jurat deployment (the pages at /report and /status), where a member of the public can file a non-emergency report and later check on it. No account or sign-in is needed. The agency that receives a report decides what is done with it and is responsible for it as the controller of that record; Ultra Far Consulting, LLC (d/b/a Jurat) processes it on the agency's behalf.

• What the report form collects: the type of incident and the details you choose to give (when and where it happened, a description, and information about people, vehicles or property involved); any photos or files you attach; and, only if you choose to give them, your name and contact details (email address and mobile phone number). Some report types can be submitted anonymously, and some require your name and contact information; the form tells you which before you submit.
• What is handled automatically: technical information such as your IP address is used to limit abuse (rate limiting) and may appear in audit records. When the agency has turned it on, the report form uses Cloudflare Turnstile to tell people from automated programs, and your browser then exchanges technical information with Cloudflare. Address search and the map are provided through Jurat's own servers. There is no advertising and no third-party analytics on the online reporting pages.
• What is saved on your device: your language choice (a cookie named jurat_lang, kept for up to one year) and, while a report is in progress, a resume code in your browser's local storage so you can come back to it. The code is removed when you submit.
• Status lookup: to check a report you enter the incident number and PIN shown when you submitted it. The page shows only the report's current status, a standard description of that status and, if the report was declined, the reason the agency chose to make public. Anyone who has both values can look the report up, so keep them private.
• Messages about your report: if you give an email address or mobile number and agree to be contacted, you may receive a confirmation that includes your incident number (by email and, if you gave a mobile number, one text message), and the agency may email you when the status of the report changes. Text messages end with "Reply STOP to opt out, HELP for help." Message and data rates may apply. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes (see Section 4).
• Retention: submitted reports are kept according to the receiving agency's records retention schedule. A report you start but never submit is removed after the period the agency has set for unsubmitted drafts.
• Questions and requests about your report: to ask about, correct or request access to the information in a report, contact the agency that received it and give your incident number. If you cannot reach the agency, you can contact us using the details in Section 8.

For questions regarding this Privacy Policy or our data security practices, contact:

• Ultra Far Consulting, LLC (d/b/a Jurat) — Jurat Legal & Privacy Office
• Email: jz@goultrafar.com
• Platform: https://gfr-gfz-public.myjurat.com