<?xml version="1.0" encoding="UTF-8"?>
<!--
  Every publicly indexable URL on sigsent.com. That is a short list by design:
  the tokenised routes (/review, /shared-results, /upload, /invite) and the whole
  authenticated surface are disallowed in robots.txt and emit noindex at runtime.

  /login is deliberately absent. It serves the same document as / and declares
  / as its canonical, so listing it would only ask Google to crawl a duplicate.

  No <lastmod>. Google ignores changefreq and priority outright and only trusts
  lastmod when it is consistently accurate — a hand-maintained date on a file
  nobody remembers to touch is worse than no date at all.

  This file must exist as a real file. Before it did, /sitemap.xml fell through
  to the SPA rewrite in vercel.json and returned index.html with
  content-type: text/html — a soft 404 that looks like a valid sitemap.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://sigsent.com/</loc>
  </url>
  <url>
    <loc>https://sigsent.com/privacy</loc>
  </url>
  <url>
    <loc>https://sigsent.com/terms</loc>
  </url>
</urlset>
