# robots.txt - PersonaXpand (https://personaxpand.com)
#
# Public marketing and legal pages are crawlable. The authenticated app is
# behind login and self-protects: anonymous requests redirect to sign-in, so
# those routes are not explicitly disallowed here. Only private user-uploaded
# media is blocked. Do NOT blanket-disallow /css, /js or /lib — Google needs
# them to render the public pages.

User-agent: *
Allow: /

# Private, user-uploaded media (avatars, post assets)
Disallow: /uploads/

# AI assistants and AI search crawlers - explicitly ALLOWED (2026-09-03) so the
# site can be cited by ChatGPT, Claude, Gemini, Perplexity, Meta AI and Apple
# Intelligence. A bot with its own group ignores the "*" group, so the private
# media rule is repeated here. NOTE: Cloudflare's "Set your preference to block
# training in robots.txt" (Security > Settings > Bot traffic) PREPENDS
# "Disallow: /" groups for several of these bots; RFC 9309 merges same-agent
# groups and lets the least restrictive rule win on a tie, but that toggle must
# stay OFF for the served file to be clean.
User-agent: GPTBot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: ClaudeBot
User-agent: Claude-User
User-agent: Claude-SearchBot
User-agent: anthropic-ai
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Google-Extended
User-agent: GoogleOther
User-agent: Applebot-Extended
User-agent: Amazonbot
User-agent: FacebookBot
User-agent: meta-externalagent
User-agent: DuckAssistBot
Allow: /
Disallow: /uploads/

# Aggressive scraper with no search surface for our market
User-agent: Bytespider
Disallow: /

Sitemap: https://personaxpand.com/sitemap.xml
# Per-user public identity pages (/@handle): /sitemap-users.xml serves a valid but EMPTY urlset
# until SearchPresence indexing is switched on. Re-add its Sitemap: line here at that point;
# listing it while empty only gets flagged by site audits as "sitemap contains no URLs".