User-agent: *
Allow: /$
Allow: /login
Allow: /register
Allow: /terms
Allow: /privacy

# Authenticated app + backend surfaces have no SEO value — keep crawlers
# out so they don't waste crawl budget on the SPA shell or hit JSON endpoints.
# (Advisory only; does not affect functional access, e.g. the MCP/OAuth flow.)
Disallow: /api/
Disallow: /oauth/
Disallow: /mcp
Disallow: /.well-known/
Disallow: /dashboard
Disallow: /transactions
Disallow: /invoices
Disallow: /timesheets
Disallow: /clients
Disallow: /projects
Disallow: /reports
Disallow: /settings
Disallow: /tokens
Disallow: /cli-auth

Sitemap: https://usetimebook.com/sitemap.xml