# unpaged.io — public pages are indexable.
# Staging must never be indexed: deploy-staging.yml replaces this file with an
# Allow-all version and patches firebase.json to serve
# `X-Robots-Tag: noindex, nofollow` on every response. Allowing the crawl is
# deliberate there — see below.
# /login and /register stay crawlable on purpose: they are public entry
# points with navigational search value ("unpaged login"). Only
# authed areas and mid-flow pages are blocked.
#
# The token-bearing paths /shared-view/, /join/, and /invite/ are NOT listed here. A
# Disallow-ed URL is never crawled, so the `noindex` that shareOgMeta emits on
# those responses would never be *seen* — leaving a publicly-pasted capability
# URL indexable URL-only and impossible to remove. Crawling them is allowed so
# the noindex can do its job; shareOgMeta emits it even when the token does
# not resolve.
User-agent: *
Disallow: /documents
Disallow: /document/
Disallow: /profile
Disallow: /account
Disallow: /admin
Disallow: /verify-email
Disallow: /auth/
Disallow: /forgot-password
Disallow: /reset-password

Sitemap: https://unpaged.io/sitemap.xml