<?xml version="1.0" encoding="UTF-8"?>
<!--
  Static sitemap for CardBounty's public surfaces. The URLs below are what a
  logged-out visitor can reach; everything else (My Activity, threads, settings)
  is per-user and lives behind auth — meta robots="noindex,nofollow" on those
  views keeps crawlers out.

  Phase 1b/2 swap this for a controller-rendered dynamic sitemap that includes
  public bounty pages (one <url> per open bounty) so individual hunts get
  indexed.

  Hosts: cardbounty.app on prd, stg.cardbounty.app on stg (stg's robots.txt
  blocks all crawls, so its sitemap is moot).
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://cardbounty.app/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/bounty/index</loc>
    <changefreq>daily</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/signup</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/login</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/about</loc>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/help</loc>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/share</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/contact</loc>
    <changefreq>monthly</changefreq>
    <priority>0.4</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/terms</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://cardbounty.app/site/privacy</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
