# Replio — robots.txt
# Public marketing pages are open to all crawlers; logged-in app pages are kept out of indexes.
#
# ⚠️ DO NOT ADD `Disallow:` RULES FOR PAGES YOU WANT OUT OF GOOGLE. It does the opposite.
#
# Keeping a page out of the index is the job of `<meta name="robots" content="noindex, nofollow">`,
# and Googlebot can only obey that tag if it is allowed to CRAWL the page and read it. A Disallow
# blocks the crawl, so the noindex is never seen — and Google will still index the URL from inbound
# links alone, as a bare result with no title or snippet, which is worse than not blocking at all.
# That is Search Console's "Indexed, though blocked by robots.txt", and it is unfixable while the
# Disallow stands: you cannot de-index a URL Google is not permitted to re-crawl.
#
# The app pages below (app/connect/dashboard/admin/inbox/pay/reset/chat/store) each carry
# `noindex, nofollow` in their own <head>. Letting crawlers fetch them costs nothing — they are
# login-gated shells with no data in the HTML — and it is what actually gets them dropped.

User-agent: *
Allow: /

# The two Disallow rules below are NOT exceptions to the warning above, and re-reading that
# warning before touching them is the point: it forbids disallowing PAGES YOU WANT OUT OF THE
# INDEX, because a Disallow stops Googlebot reading the noindex that would remove them. Neither
# path below is an HTML page. There is no meta tag to read, no snippet to suppress and nothing to
# de-index — only crawl budget being spent on URLs that can never rank.
#
# /api/*        JSON endpoints, most of them POST-only. Googlebot GETs them and gets a 4xx, which
#               is why Search Console listed 6 of them under "Blocked due to other 4xx issue" on
#               2026-09-04 (/api/signup, /api/login, /api/forgot, /api/passkey/login/begin,
#               /api/signup/unblock, /api/signup/captcha-blocked).
# /tree/*/go/*  Click-tracked outbound redirects from a tenant's Bio Link page. Google found them
#               by following the links on /tree/replio and reported 10 of them across "Page with
#               redirect", "Redirect error" and "Blocked by robots.txt" on the same day. They are
#               in no sitemap and each one is a 302 to somebody else's site.
Disallow: /api/
Disallow: /tree/*/go/

# AI answer engines — both their training crawlers and the bots they use to fetch a page live
# when a user asks about it — are explicitly welcome to read our public content, so Replio can be
# surfaced/cited in Google AI Overviews, ChatGPT, Claude, Perplexity, Gemini, DuckDuckGo AI and
# Mistral's Le Chat. This list is already redundant with `User-agent: *` above (which allows
# everyone), but naming these explicitly documents the intent and keeps them welcome even if `*`
# is ever tightened for unrelated bot-abuse reasons.
User-agent: GPTBot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: ClaudeBot
User-agent: Claude-User
User-agent: Claude-SearchBot
User-agent: anthropic-ai
User-agent: Claude-Web
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Google-Extended
User-agent: Google-Agent
User-agent: Applebot-Extended
User-agent: Amazonbot
User-agent: cohere-ai
User-agent: Meta-ExternalAgent
User-agent: DuckAssistBot
User-agent: MistralAI-User
Allow: /

Sitemap: https://replio.live/sitemap.xml
# Generated from the database — one entry per live directory listing (/c/<slug>).
Sitemap: https://replio.live/sitemap-directory.xml
# LLM-friendly site summary: https://replio.live/llms.txt