<?xml version="1.0" encoding="UTF-8"?>
<!--
  Five URLs, because five are all that exist publicly. Every other route is
  behind the workspace guard and is disallowed in robots.txt.

  Password recovery routes are deliberately absent: they are reached from an
  emailed link, and listing them invites crawlers to hit a flow that only makes
  sense with a token.

  Static on purpose. A generated sitemap would need a build step to describe a
  set that changes only when a public route is added.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://on-file.app/</loc>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://on-file.app/login</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://on-file.app/signup</loc>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://on-file.app/privacy</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://on-file.app/terms</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
