<?xml version="1.0" encoding="UTF-8"?>
<!--
  Only publicly reachable, non-auth URLs belong here. / is the public landing
  page (index.html) — real static content, the one canonical entry point, and
  where ads and Stripe review land. The authenticated app shell lives at /app
  (app.html); it is noindex + robots-disallowed and never belongs here, and
  /login.html carries a rel=canonical back to / rather than appearing as its
  own entry.

  The legal pages are served at extensionless URLs (/legal/privacy, not
  /legal/privacy.html — the .html form 404s), so those are the forms listed.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://hiddenprism.app/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://hiddenprism.app/legal/privacy</loc>
    <changefreq>monthly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://hiddenprism.app/legal/terms</loc>
    <changefreq>monthly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
