<?xml version="1.0" encoding="UTF-8"?>
<!--
  public/sitemap.xml

  robots.txt has advertised https://app.iava.ai/sitemap.xml since it was
  written, but the file never existed — every crawler that asked for it got the
  SPA's index.html back. This is the real one.

  Only genuinely public, crawlable URLs belong here. The legal pages are the
  point: Router.jsx resolves /terms, /privacy and /disclaimer BEFORE its
  authenticated-app check, and vercel.json's SPA rewrite serves them on a cold
  deep link, so each is a stable public URL a crawler or an app-store reviewer
  can reach without an account.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://app.iava.ai/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://app.iava.ai/login</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://app.iava.ai/terms</loc>
    <lastmod>2026-08-15</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://app.iava.ai/privacy</loc>
    <lastmod>2026-08-15</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://app.iava.ai/disclaimer</loc>
    <lastmod>2026-08-15</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
