<?xml version="1.0" encoding="UTF-8"?>
<!--
  18-13 — the four PRE-RENDERED public URLs, and only those.

  Every entry here is emitted as a real file by scripts/prerender.mjs and served by an
  explicit route in server/index.js (the PRERENDERED map), so a crawler that runs no
  JavaScript receives the actual page rather than the empty SPA shell. Listing anything else
  would point Google at `<div id="root"></div>`, which is the defect this phase closed.

  The signed-in routes (/dashboard, /content, /settings …) are deliberately absent: they
  require a session, render nothing without one, and are not documents.

  NOT copied from the repo root's public/sitemap.xml — that file points at crosspost.app,
  which is not our domain.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://app.joincrosspost.com/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://app.joincrosspost.com/privacy</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://app.joincrosspost.com/terms</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://app.joincrosspost.com/data-deletion</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
</urlset>
