<?xml version="1.0" encoding="UTF-8"?>
<!--
  The indexable pages, and only those.

  Checked against `src/routes.ts` by `scripts/check-routes.mjs`, which fails the build if this
  file and `ROUTES` disagree — a sitemap naming a page that 404s is worse than no sitemap, and
  one that omits a real page quietly undoes the reason for having it.

  **No `lastmod`, deliberately.** Google uses it only where it is consistently truthful, and a
  date written by hand here would be a date nobody remembers to change — which teaches the
  crawler to ignore the field and costs the credibility of the whole file. Six URLs need no
  discovery help; what this buys is the coverage report in Search Console, and that does not
  read `lastmod`. Add one when a build step can compute it honestly.

  `/authorize` and `/connect` are absent because they are credential flows, not destinations.
  They are still served and still crawlable; see `public/robots.txt` for why that is the right
  way round.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://heysquint.com/</loc></url>
  <url><loc>https://heysquint.com/terms</loc></url>
  <url><loc>https://heysquint.com/privacy</loc></url>
  <url><loc>https://heysquint.com/refunds</loc></url>
</urlset>
