<?xml version="1.0" encoding="UTF-8"?>
<!--
  Every address of portal.ekovoltis.pl that a visitor can read WITHOUT signing in — all four of them.
  They are not a selection from a larger set: the router guard (client/src/app/router.ts) grants exactly
  these exceptions, everything else resolves a session and redirects to /login. Owner decision (2026-08-26):
  the marketing site and the sign-in gate both stay in the map.

  Two things are deliberately absent:
    • /zaproszenie/<token> — pre-session too, but the token IS the affiliation secret;
    • the marketing site's sections — they are anchors on one page, not addresses.

  <changefreq> and <priority> are absent on purpose: Google ignores both, and a number nobody reads is a
  number that drifts. lastmod is each page's own last source change, taken from git.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <!-- The public marketing site (ADR-0039). For a signed-in visitor the same address redirects into the
       portal — invisible to a crawler, which never has a session. -->
  <url>
    <loc>https://portal.ekovoltis.pl/</loc>
    <lastmod>2026-08-10</lastmod>
  </url>

  <!-- The sign-in gate. Kept indexable so the brand + "logowanie" query is answered directly instead of
       sending the customer through the marketing page first. -->
  <url>
    <loc>https://portal.ekovoltis.pl/login</loc>
    <lastmod>2026-08-20</lastmod>
  </url>

  <!-- Legal pages: pre-session because the registration consent sentence links to them, which is also
       what makes them readable in full without an account. -->
  <url>
    <loc>https://portal.ekovoltis.pl/regulamin</loc>
    <lastmod>2026-08-20</lastmod>
  </url>
  <url>
    <loc>https://portal.ekovoltis.pl/polityka-prywatnosci</loc>
    <lastmod>2026-08-21</lastmod>
  </url>
</urlset>
