<?xml version="1.0" encoding="UTF-8"?>
<!--
  Added 2026-08-21 with the custom-domain cutover.

  Only the three genuinely static, publicly readable pages are listed. Each
  is served straight from S3 via CloudFront with no path rewrite (see
  privacy.html and terms.html's own head comments, and the CloudFront
  Function in amplify/backend.ts, which rewrites only bare /app).

  /app is deliberately absent and is also Disallow'd in robots.txt — it is a
  login-walled SPA shell with no crawlable content.

  No <lastmod>: a wrong or never-updated lastmod is treated as a negative
  signal by crawlers that trust it, and there is no build step wiring real
  modification dates in yet. Omitting it is honest; faking it is not.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://candour-app.com/</loc>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://candour-app.com/privacy.html</loc>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://candour-app.com/terms.html</loc>
    <priority>0.3</priority>
  </url>
</urlset>
