<?xml version="1.0" encoding="UTF-8"?>
<!--
  Public URLs only. Nothing behind the gate belongs here: a sitemap is a
  published list of what is worth crawling, and listing /admin would be
  volunteering the map. Extension-less form, because that is what the asset
  store serves as canonical and it is what <link rel="canonical"> declares.

  Keep this in step with public/robots.txt and with the OPEN list in
  src/auth.js. A URL listed here but gated is a crawl error on every pass.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://vosky.ai/</loc>
    <lastmod>2026-07-25</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <!--
    /terms and /data were listed here until 2026-07-28, alongside /privacy. They
    are now released on request and gated, so listing them would be a crawl
    error on every pass. robots.txt disallows them for the same reason.

    /privacy was listed here from 2026-07-29 until 2026-09-05, at priority 0.8.
    It was the one policy document published openly, and this entry was what
    actively invited a crawler to it -- which made it the only page on the domain
    that could be indexed at all, since everything else 302s and carries
    X-Robots-Tag: noindex. It describes handling still being built, so it came
    out along with the rest until the site is live.

    When the gate is reopened, restore these seven together, with a current
    lastmod, and delete their Disallow lines:

      /privacy          /security           /dpa
      /terms            /acceptable-use     /outreach
      /data

    /privacy is the one of the seven that is not optional -- see the note in
    src/auth.js. It also reopens by itself when PRIVATE_SITE flips; this file
    and robots.txt are the parts that do not, which is why they are listed here.

    Two deliberate omissions, and they stay omitted even after switch-on:

      /nda is a document sent to one named counterparty at a time. There is
      nothing to rank and no reason to invite a crawler to it.

      /.well-known/security.txt is fetched directly by the tools that want it.
      It is not a page and does not belong in a sitemap.

      /sample is public and stays unlisted. It is a link you send to a prospect,
      not a page meant to rank: it carries published build prices, and it is
      served with noindex. Listing it here would contradict the meta tag on the
      page itself and put the two files into a fight the crawler resolves.
  -->
</urlset>
