<?xml version="1.0" encoding="UTF-8"?>
<!--
  Every publicly indexable URL on sigsent.com. That is a short list by design:
  the tokenised routes (/review, /shared-results, /upload, /invite) and the whole
  authenticated surface are disallowed in robots.txt and emit noindex at runtime.

  /login and /request-access are deliberately absent: both carry
  noindex,nofollow,noarchive and their own canonical (not a duplicate of /).
  Listing a noindexed URL here would contradict that directive -- a sitemap
  should only list canonical, indexable URLs. /request-access is a thin,
  form-only conversion endpoint reached from every "Request access" CTA on
  the site, not a page worth surfacing as its own organic search result --
  traffic should land on the explanatory homepage instead.

  No <lastmod>. Google ignores changefreq and priority outright and only trusts
  lastmod when it is consistently accurate — a hand-maintained date on a file
  nobody remembers to touch is worse than no date at all.

  This file must exist as a real file. Before it did, /sitemap.xml fell through
  to the SPA rewrite in vercel.json and returned index.html with
  content-type: text/html — a soft 404 that looks like a valid sitemap.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://sigsent.com/</loc>
  </url>
  <url>
    <loc>https://sigsent.com/privacy</loc>
  </url>
  <url>
    <loc>https://sigsent.com/terms</loc>
  </url>
</urlset>
