<?xml version="1.0" encoding="UTF-8"?>
<!--
  The three public pages, and deliberately nothing else. /app is excluded here,
  in robots.txt, and by a noindex meta tag in app/index.html — a sitemap entry
  for it would contradict all three, and Search Console reports exactly that
  contradiction as an error rather than silently preferring one.

  The URLs are extensionless because vercel.json sets `cleanUrls: true`:
  /privacy.html 301s to /privacy, and a sitemap full of redirects is a sitemap
  full of warnings.

  <changefreq> and <priority> are omitted on purpose. Google has said publicly
  that it ignores both, and an unread hint that has to be kept honest by hand is
  worse than no hint.

  <lastmod> is the date of the page's own content, not of this file. It is
  read-and-believed only while it stays plausible, so update the entry you
  actually changed and leave the others alone. The two legal pages carry a
  "Last updated" line in their own copy — keep the two in step, since they are
  the same claim made twice.

  If the production domain ever moves, all three <loc> values move with it;
  the full list of files that name it is in the head of index.html.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://baseline-budget.com/</loc>
    <lastmod>2026-08-03</lastmod>
  </url>
  <url>
    <loc>https://baseline-budget.com/privacy</loc>
    <lastmod>2026-08-03</lastmod>
  </url>
  <url>
    <loc>https://baseline-budget.com/terms</loc>
    <lastmod>2026-07-19</lastmod>
  </url>
</urlset>
