User-agent: *
Allow: /

# Private app routes (authenticated areas)
Disallow: /*/inbox
Disallow: /*/sent
Disallow: /*/drafts
Disallow: /*/trash
Disallow: /*/starred
Disallow: /*/compose
Disallow: /*/search
Disallow: /*/mailboxes
Disallow: /*/mailbox-groups
Disallow: /*/transfers
Disallow: /*/settings
Disallow: /*/admin
Disallow: /*/offline

# Auth flows (no index value, can cache auth redirects)
Disallow: /*/auth/callback
Disallow: /*/choose-destination

# Auth pages — allow crawling entry points but mark intent
# (login/register stay indexable as conversion landing pages)

# Deny query-heavy, non-canonical URLs
Disallow: /*?utm_
Disallow: /*&utm_

# Next.js auto-generated metadata routes — Google indexed them as
# redirecting "pages" (e.g. /uk/opengraph-image?<hash>). These are
# binary assets meant to be embedded in social cards, not crawled
# standalone. Blocking the path family stops them showing up under
# Search Console's "Page with redirect" report.
Disallow: /*/opengraph-image
Disallow: /opengraph-image
Disallow: /*/twitter-image
Disallow: /twitter-image
Disallow: /*/icon
Disallow: /*/apple-icon

Sitemap: https://qmailing.com/sitemap.xml