<?xml version="1.0" encoding="UTF-8"?>
<!--
  Five pages, and deliberately not the account pages. Every URL that reaches
  those carries a single-use code in its query string, so a crawler that
  fetched one would spend it. They are not on this origin at all any more:
  auth.geargenius.app serves them behind an X-Robots-Tag set in firebase.json,
  which is why robots.txt here no longer names them.

  The addresses here are EXTENSIONLESS, because that is what the server
  serves: Cloudflare answers /privacy.html with a 307 to /privacy. A sitemap
  full of redirects asks every crawler to make two requests to learn what one
  would have told it.

  `lastmod` is the date the page's WORDS changed, not the date the file was
  touched. The two legal pages carry a visible "Last updated" stamp, and a
  sitemap that disagreed with what the reader can see would be the site
  contradicting itself about its own documents.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://geargenius.app/</loc>
    <lastmod>2026-09-02</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://geargenius.app/faq</loc>
    <lastmod>2026-09-02</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>
  <url>
    <loc>https://geargenius.app/privacy</loc>
    <lastmod>2026-09-04</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://geargenius.app/credits</loc>
    <lastmod>2026-09-04</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://geargenius.app/terms</loc>
    <lastmod>2026-09-04</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
</urlset>
