<?xml version="1.0" encoding="UTF-8"?>
<!-- lastmod must track the page's real last content change. Frozen dates are
     worse than no dates: a crawler that learns lastmod is unreliable stops
     using it, and the pages that DID change lose the signal along with the
     ones that didn't. Update the date on the page you actually edited. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <!-- Main website -->
  <url>
    <loc>https://nuaj.com/</loc>
    <lastmod>2026-08-04</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>

  <!-- Product pages -->
  <!-- NuajProtect: launching beta — primary SEO focus -->
  <url>
    <loc>https://nuaj.com/nuajprotect</loc>
    <lastmod>2026-08-04</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://nuaj.com/nuajlens</loc>
    <lastmod>2026-08-03</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.8</priority>
  </url>
  <!-- Nexaplane: launches 2027 — kept indexed at low weight to build authority early -->
  <url>
    <loc>https://nuaj.com/nexaplane</loc>
    <lastmod>2026-08-03</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.3</priority>
  </url>

  <!-- Legal and security — low crawl priority, but they must be indexable. The
       consent banner and every footer point at /privacy, security.txt points at
       /security, and a policy that cannot be found reads as one that does not
       exist. -->
  <url>
    <loc>https://nuaj.com/privacy</loc>
    <lastmod>2026-08-04</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://nuaj.com/security</loc>
    <lastmod>2026-08-04</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>

  <!-- The /lp/* campaign pages are deliberately NOT listed, and now carry
       noindex. They restate the NuajProtect page's content for a specific ad
       audience, so indexing them puts our own primary SEO page in competition
       with three near-duplicates. Paid traffic is unaffected: ads link to them
       directly and never rely on the index. -->
</urlset>
