<?xml version="1.0" encoding="UTF-8"?>
<!-- Static sitemap: only deliberately-indexable public pages.
     Every URL here must return 200 (no redirect), be allowed by
     robots.txt, and carry a self-referencing canonical.
     The root / is intentionally NOT listed: it 301s to /login,
     which is the canonical public page.
     The robots.txt Allow list is a SUPERSET of this file and must not
     be mirrored into it. /terms and /cookies are deliberately allowed
     in robots.txt while serving noindex — they are crawlable so Google
     can read that noindex, but listing a noindex URL in a sitemap is
     itself a Search Console error. Crawlable != indexable.
     What must stay in sync is this file and the per-page robots meta
     policy (login.php, changelog.php, legal.php): every URL below
     serves "index, follow", and nothing that serves noindex belongs here.
     App, workspace, tenant, and token pages are intentionally absent. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://hrcluster.app/login</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/changelog</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/privacy</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/security</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/dpa</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/subprocessors</loc>
  </url>
</urlset>
