<?xml version="1.0" encoding="UTF-8"?>
<!-- Only real, public, signed-out-reachable routes belong here.
     Everything else in the SPA is auth-gated and disallowed in robots.txt.
     NOTE: Firebase Hosting's catch-all rewrite serves index.html (HTTP 200)
     for ANY path, so a bad URL here would never 404 — keep this list in
     sync with the public routes in src/App.jsx by hand. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://till3.com/</loc>
    <lastmod>2026-07-07</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://till3.com/safety</loc>
    <lastmod>2026-07-07</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
  <url>
    <loc>https://till3.com/login</loc>
    <lastmod>2026-07-07</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.4</priority>
  </url>
  <url>
    <loc>https://till3.com/legal/privacy</loc>
    <lastmod>2026-07-07</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.2</priority>
  </url>
  <url>
    <loc>https://till3.com/legal/terms</loc>
    <lastmod>2026-07-07</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.2</priority>
  </url>
</urlset>
