# Kineclip — robots.txt
# Declares both traditional crawl directives and Content Signals (contentsignals.org)
# for AI training / search / agent-input preferences.
#
# Preferences (Defensive stance for an AI SaaS):
#   ai-train=no   — do not use our content as AI training data
#   search=yes    — classic search indexing + AI-powered search citations are welcome
#   ai-input=yes  — agents may fetch pages as context for a user's query right now
User-Agent: *
Content-Signal: ai-train=no, search=yes, ai-input=yes
Allow: /
Disallow: /dashboard/
Disallow: /admin/
Disallow: /admin-login/
Disallow: /coming-soon/
Disallow: /forgot-password/
Disallow: /reset-password/

# ⚠️ THE THREE RULES BELOW ARE A SAFETY CONTROL, NOT AN SEO CHOICE.
# Do not remove them to "let Googlebot read the noindex tag". Every route they
# cover is reached by a single-use token mailed to one customer, and two of the
# three still SPEND that token ON PAGE LOAD, from a `useEffect` in a client
# component — and Googlebot executes JavaScript, so a crawl is indistinguishable
# from a real visit:
#
#   /verify-email/        GET /email/verify?token=…   consumes the verification
#                         token ON LOAD  (src/app/verify-email/page.tsx)
#   /auth/*/callback/     POST /social/platform-accounts/connect-public with the
#                         single-use OAuth `code` ON LOAD  (facebook, instagram,
#                         tiktok, youtube — each …/callback/page.tsx)
#   /unsubscribe/         NO LONGER ACTS ON LOAD. The page renders a confirmation
#                         and only POSTs /email/unsubscribe from a button click
#                         (src/app/unsubscribe/page.tsx); the API's GET half is
#                         read-only and 302s here. The rule stays anyway: the URL
#                         is a mailed, token-bearing page with nothing to index,
#                         and the Disallow is the standing guard for the day this
#                         page — or its API verbs — regains a load-time effect.
#                         That is exactly the regression it is here to catch, so
#                         do not drop the rule just because it is idle today.
#
# If one of these URLs ever becomes crawlable while it still carries a live
# token, a crawler burns it and the customer's link silently stops working.
# Blocking the crawl is what prevents that.
#
# The known trade-off, accepted deliberately: Disallow stops the CRAWL, so
# Googlebot never fetches the page and never reads the `robots: noindex` these
# routes also declare. A disallowed URL can therefore still be indexed URL-only
# from an inbound link. That is the weaker guarantee, and it is the correct
# trade here — these are token-bearing links that are mailed, never published,
# so they have no inbound links to be indexed from. The noindex stays as
# defence in depth for the day one of these routes stops acting on load.
Disallow: /auth/
Disallow: /verify-email/
Disallow: /unsubscribe/

Sitemap: https://kineclip.com/sitemap.xml