<?xml version="1.0" encoding="UTF-8"?>
<!--
  carry.today has three indexable URLs: the landing page, the privacy policy
  and the terms of service. The api/s3/updates subdomains are machine
  endpoints rather than pages.

  /app/* is the signed-in SPA and is deliberately absent from this file. Note
  that it is kept out of the index by `X-Robots-Tag: noindex` at the edge, NOT
  by a robots.txt Disallow — the two cannot be combined, and robots.txt carries
  the explanation. Leaving it out of the sitemap is consistent with that: a
  noindexed URL should not be submitted for indexing. It stays crawlable on
  purpose.

  This file is what robots.txt points at, it gives the canonical host (no www,
  trailing slash) in a second place besides rel=canonical, and it carries
  lastmod. Add an entry here when a real page is added — not when the SPA
  gains a route.

  Every <lastmod> must match the <time datetime> and the JSON-LD dateModified
  on the page it names. The two legal pages state their own last-updated date
  to the reader, so a sitemap claiming a different one contradicts the
  document in a machine-readable way.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://carry.today/</loc>
    <lastmod>2026-10-08</lastmod>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://carry.today/privacy/</loc>
    <lastmod>2026-10-09</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://carry.today/terms/</loc>
    <lastmod>2026-10-08</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
</urlset>
