<?xml version="1.0" encoding="UTF-8"?>
<!--
  Voystac sitemap — added 2026-09-23. There was none before, and robots.txt now points here.

  WHAT IS LISTED: the stable, public, server-addressable pages. Every entry is a route declared in App.tsx
  outside ProtectedRoute, so each one genuinely renders for a signed-out visitor.

  WHAT IS DELIBERATELY NOT LISTED:
    * /stays/{id}, /community/collections/{id}, /community/destinations/{placeId} — these are the pages that
      would actually earn search traffic, and they cannot be enumerated by hand: they change whenever the
      catalogue does, and a hand-written list goes stale silently. They need GENERATING from the catalogue at
      publish time (or serving from the API). Tracked as a follow-up; a wrong sitemap is worse than a partial
      one, because it teaches crawlers to distrust the file.
    * Anything under /app/, the auth routes and /search with a query string — all Disallowed in robots.txt.

  NO <lastmod>, <changefreq> OR <priority>. Every value would have to be invented: nothing in the build
  records when a given public page last changed. Google ignores changefreq and priority outright, and a
  fabricated lastmod is worse than none — it trains the crawler to disregard the field. They belong here only
  once the generator above exists and can supply real values.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://voystac.com/</loc></url>
  <url><loc>https://voystac.com/search</loc></url>
  <url><loc>https://voystac.com/experiences</loc></url>
  <url><loc>https://voystac.com/community</loc></url>
  <url><loc>https://voystac.com/about</loc></url>
  <url><loc>https://voystac.com/contact</loc></url>
  <url><loc>https://voystac.com/terms</loc></url>
  <url><loc>https://voystac.com/privacy</loc></url>
</urlset>
