<?xml version="1.0" encoding="UTF-8"?>
<!--
  Only publicly reachable pages belong here.

  Everything under ProtectedRoute (/dashboard, /track, /diet, /profile,
  /pricing, /about, /contact, /admin …) redirects to /login for a signed-out
  visitor — and Googlebot is always signed out. Listing those URLs would tell
  Search Console about pages that can only ever return a login screen, which
  shows up as "Page with redirect" errors and teaches Google that the site is
  mostly inaccessible.

  Also deliberately excluded:
    /landing          duplicate of /, would be flagged as duplicate content
    /forgot-password  transient, nothing to index
    /reset-password   transient, and only valid with a token
-->
<urlset xmlns="http://www.sitemap.org/schemas/sitemap/0.9">

  <url>
    <loc>https://orbitfit365.com/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/about-us</loc>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/contact-us</loc>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/login</loc>
    <changefreq>yearly</changefreq>
    <priority>0.4</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/register</loc>
    <changefreq>yearly</changefreq>
    <priority>0.6</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/privacy-policy</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/terms-of-use</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>

  <url>
    <loc>https://orbitfit365.com/delete-data</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>

</urlset>
