<?xml version="1.0" encoding="UTF-8"?>
<!--
  Public URLs only. Nothing behind the gate belongs here: a sitemap is a
  published list of what is worth crawling, and listing /admin would be
  volunteering the map. Extension-less form, because that is what the asset
  store serves as canonical and it is what <link rel="canonical"> declares.

  Keep this in step with public/robots.txt and with the OPEN list in
  src/auth.js. A URL listed here but gated is a crawl error on every pass.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://vosky.ai/</loc>
    <lastmod>2026-07-25</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <!--
    /privacy is here and the rest of the policy set is not, and that is not an
    oversight. It is the one policy document published openly: it is in OPEN in
    src/auth.js, it is reachable whatever PRIVATE_SITE is set to, and it carries
    the request form that releases all the others. A vendor-risk team finding it
    is the entire point, so it is the one page in this set worth crawling.
  -->
  <url>
    <loc>https://vosky.ai/privacy</loc>
    <lastmod>2026-07-29</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <!--
    /terms and /data were listed here until 2026-07-28, alongside /privacy. They
    are now released on request and gated, so listing them would be a crawl
    error on every pass. robots.txt disallows them for the same reason.

    The policy set has grown since. When the gate is reopened, restore these six
    together, with a current lastmod, and delete their Disallow lines:

      /terms            /security           /dpa
      /data             /acceptable-use     /outreach

    Two deliberate omissions, and they stay omitted even after switch-on:

      /nda is a document sent to one named counterparty at a time. There is
      nothing to rank and no reason to invite a crawler to it.

      /.well-known/security.txt is fetched directly by the tools that want it.
      It is not a page and does not belong in a sitemap.
  -->
</urlset>
