<?xml version="1.0" encoding="UTF-8"?>
<!--
  Every indexable page: the landing page, the terms and the privacy policy,
  each in English and Spanish. Everything else is behind PrivateRoute and
  Disallowed in public/robots.txt, and /login renders the landing page as the
  backdrop behind its modal.

  Each of these except / is served from its own generated HTML
  (scripts/build-static-pages.mjs), which is what lets it carry its own
  canonical, lang and hreflang pair — see the comment on the canonical in
  index.html. changefreq and priority are deliberately absent: Google ignores
  both.

  Both hosts are the VITE_SITE_URL placeholder, substituted into
  dist/sitemap.xml by that same script, so the host here cannot drift from the
  canonical — it is one value. lastmod stays hand-maintained on purpose:
  stamping it with the build date would re-date both URLs on every unrelated
  deploy, which is a signal worth keeping honest.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://rifapp-fc41d.web.app/</loc>
    <lastmod>2026-10-15</lastmod>
  </url>
  <url>
    <loc>https://rifapp-fc41d.web.app/es</loc>
    <lastmod>2026-10-18</lastmod>
  </url>
  <url>
    <loc>https://rifapp-fc41d.web.app/terms</loc>
    <lastmod>2026-10-27</lastmod>
  </url>
  <url>
    <loc>https://rifapp-fc41d.web.app/es/terms</loc>
    <lastmod>2026-10-27</lastmod>
  </url>
  <url>
    <loc>https://rifapp-fc41d.web.app/privacy</loc>
    <lastmod>2026-10-27</lastmod>
  </url>
  <url>
    <loc>https://rifapp-fc41d.web.app/es/privacy</loc>
    <lastmod>2026-10-27</lastmod>
  </url>
</urlset>
