# Haunted 365
#
# Public pages — the haunt directory, job board, and marketing pages — are open
# to crawlers, AI crawlers included. That is deliberate. Member-authored content
# lives behind authentication and is never served to an unauthenticated request,
# so the auth wall is the control here, not this file.
#
# Note what is NOT listed below: the authenticated paths (/app, /haunter, and
# the per-tenant HR routes). Well-behaved crawlers already stop at the login
# redirect, and naming those prefixes here would only advertise them to the
# crawlers that ignore this file.
#
# There is no Content-Signal line by design. Nothing is restricted today, and
# staying silent preserves the option to restrict later without having first
# published an express grant.

User-agent: *
Allow: /

# Endpoints with nothing worth indexing. The /claim, /badges/claim, /booth and
# /users token paths carry single-use credentials in the URL and must never
# enter a search index; the rest simply burn crawl budget.
Disallow: /api/
Disallow: /proxy/photo
Disallow: /media/
Disallow: /booth/
Disallow: /claim/
Disallow: /badges/claim/
Disallow: /staff/accept/
Disallow: /users/

Sitemap: https://www.haunted365.com/sitemap.xml