# AttendanceSheeter - Privacy-First Digital Sign-In Sheets

User-agent: *
Allow: /

# ─────────────────────────────────────────────────────────────────────────────
# Private areas are deliberately NOT Disallowed below.
#
# Every private route emits <meta name="robots" content="noindex, nofollow">.
# A crawler that is Disallowed from fetching a page never SEES that tag, and
# the URL can still be indexed URL-only (title taken from inbound links, no
# snippet). Allowing the crawl is what actually removes a page from the index.
#
# Deindexed via noindex rather than Disallow:
#   /dashboard/  /pro/  /admin/  /checker/  /auth/  /login/  /account/
#   /attend/  /kiosk/  /debug-sheet/
#   /sheeterplus/kiosk/  /sheeterplus/dashboard/
#   /sheeterplus/attend/*  /sheeterplus/kiosk/*  /pro/attend/*  /pro/kiosk/*
#
# For the four function-served routes above, noindex must be present in EVERY
# response branch — success AND the getErrorPage() used for 404/403/500. An
# expired or invalid sheet URL is exactly the kind of link that gets shared and
# crawled, and a 403 is not a reliable removal signal on its own.
#
# Only add a Disallow here for paths that CANNOT carry a meta tag.
# ─────────────────────────────────────────────────────────────────────────────

# API endpoints — JSON responses, no HTML head to hold a meta tag
Disallow: /api/

# Scratch/uploads area — not a rendering resource
Disallow: /temp/

# NOTE: /_next/ is deliberately NOT disallowed. It holds the JS and CSS needed
# to render pages; Google's guidance is explicit that blocking those resources
# harms rendering and indexing. "Cannot carry a meta tag" is not a reason to
# block a resource directory.

# Sitemaps
Sitemap: https://attendancesheeter.com/sitemap.xml