# Recall Canary — public crawl policy.
# Sitemap is the authoritative entry point for indexable content; admin
# and write APIs are not for crawlers.
#
# Every crawler named below sits in the one `*` group, as further User-agent
# lines of that group (RFC 9309 §2.1). A crawler that matches a group of its
# own obeys that group alone, so a separate named group would drop the
# Disallows and the Content-Signal below. Cloudflare's managed robots.txt, if
# switched on, may prepend its own named groups (for example
# `User-agent: GPTBot` / `Disallow: /`). RFC 9309 §2.2.1 combines every group
# that matches a crawler, and §2.2.2 prefers `Allow: /` over an equal-length
# `Disallow`, so our Allow still wins. That protection is best-effort: a parser
# that reads only the first matching group obeys the edge's group instead.
#
# Content Signals (https://contentsignals.org/,
# draft-romm-aipref-contentsignals): our AI-use preferences for this site.
# Recall data is public-interest safety information, so all three are yes:
#   search=yes   index us and link to us in search results
#   ai-input=yes use pages as real-time grounding for AI answers
#   ai-train=yes use content for model training (matches the training
#                crawlers named below; change both together)
#
# The named AI crawlers are the training and citation / search bots that show
# Recall Canary in AI answers (Google AI Overviews, ChatGPT Search, Perplexity,
# Claude, Bing Copilot, Siri / Spotlight and so on). Each is listed explicitly
# so a future change to Cloudflare's defaults cannot sweep it out.
User-agent: *
User-agent: Google-Extended
User-agent: GPTBot
User-agent: ClaudeBot
User-agent: Applebot-Extended
User-agent: CCBot
User-agent: meta-externalagent
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: Claude-User
User-agent: Claude-SearchBot
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Applebot
User-agent: Bingbot
User-agent: Google-NotebookLM
User-agent: DuckAssistBot
User-agent: MistralAI-User
User-agent: Amzn-SearchBot
User-agent: meta-externalfetcher
Content-Signal: search=yes, ai-input=yes, ai-train=yes
Allow: /
Disallow: /admin
Disallow: /api

# /data/ is deliberately NOT disallowed. It is the public read-only JSON API
# and it is advertised in /.well-known/api-catalog, which only lists paths that
# are publicly reachable AND robots-allowed. A Disallow here would make the
# catalog advertise a path crawlers are told not to fetch — the exact
# self-contradiction tests/lib/api-catalog.test.ts guards against — and would
# cut off the named AI crawlers above from the one surface built for them. Do
# not add one by pattern-matching against /api above: nothing parses this
# file, so no test would catch it.
#
# Keeping the JSON out of the search index is handled the other way round, by
# an X-Robots-Tag: noindex header on /data/recalls, /data/changes and /data/recall/*, which
# only works BECAUSE the path stays crawlable. /data/openapi.json is exempt --
# one stable URL, no cardinality problem, meant to be found. See
# src/lib/data-api-endpoint.ts.

Sitemap: https://recallcanary.com/sitemap-index.xml