<?xml version="1.0" encoding="UTF-8"?>
<!--
  Only the pages a signed-out visitor can actually reach are listed.

  Everything behind AuthGuard is deliberately absent: a crawler following those
  URLs gets the login redirect, which is a soft-404 in Google's eyes and drags on
  the whole domain. The auth flows themselves (/login, /register,
  /forgot-password, /reset-password, /confirm-email) are excluded for the same
  reason - they are steps in a journey, not destinations, and nothing links to
  them from search. /redeem/:code is excluded because each URL is a single-use
  invitation; publishing one spends it. /auth/instagram, /data-deletion-status
  and /oauth/consent are excluded because each is a redirect target carrying a
  code in the query string, meaningless without it.

  lastmod is the date that page's own content last changed in git, not the date
  of the last deploy. A file that claims every page changed this week teaches a
  crawler to stop believing it.

  English and Arabic are the same URL - transloco swaps at runtime - so there are
  no hreflang alternates to declare. If the site ever moves to /en and /ar paths,
  each page needs an xhtml:link pair here.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://nabddah.com/</loc>
    <lastmod>2026-09-24</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://nabddah.com/pricing</loc>
    <lastmod>2026-09-17</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://nabddah.com/about</loc>
    <lastmod>2026-09-17</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
  <!-- The index only. Article URLs come out of the database, which a hand-maintained file cannot
       track and a build-time script cannot read - so they are left to be found by crawling the
       links on this page, which is enough for a crawler that follows them. A sitemap listing every
       article needs an endpoint generating it from the database. -->
  <url>
    <loc>https://nabddah.com/help</loc>
    <lastmod>2026-09-11</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.7</priority>
  </url>
  <!-- Released roughly weekly, and the page people are sent to when they ask what changed. -->
  <url>
    <loc>https://nabddah.com/changelog</loc>
    <lastmod>2026-09-29</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.5</priority>
  </url>
  <!-- The page itself rarely changes; what it reports changes constantly, and that comes from the
       API at runtime rather than from this document. daily is about the markup, not the incidents. -->
  <url>
    <loc>https://nabddah.com/status</loc>
    <lastmod>2026-09-04</lastmod>
    <changefreq>daily</changefreq>
    <priority>0.4</priority>
  </url>
  <url>
    <loc>https://nabddah.com/privacy</loc>
    <lastmod>2026-09-28</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://nabddah.com/terms</loc>
    <lastmod>2026-09-28</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <!-- Third of the three legal documents, and the URL Meta's app settings point at. nginx serves
       public/legal/data-deletion.html at this address for anything that does not run JavaScript,
       so a crawler reaching it gets the text rather than an empty shell. -->
  <url>
    <loc>https://nabddah.com/data-deletion</loc>
    <lastmod>2026-09-28</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
