An AI companion that turns goals into daily steps — and the page hygiene backs the "organized" pitch: clean 62-char title, meta description in range, exactly one H1, TLS 1.3, and a fast TTFB (~120-350ms today). Bonus points for the robots.txt: a proper AI content-signals policy (ai-search/ai-input/ai-train with the EU 2019/790 rights reservation) — first one I have seen in this launch cohort, and it is the right instinct for an AI product.
Passive launch-day check (headers + public HTML only), three findings:
All six standard security headers are unset — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. You are behind Cloudflare, so HSTS + nosniff + XFO + a baseline CSP are one Transform Rule away, no origin change. HSTS matters most: without it a first-visit downgrade can strip TLS before any redirect, and your users are handing daily plans and notes to the app.
X-Powered-By plus the x-railway-* / x-nextjs-* headers leak your exact stack (Next.js on Railway) to anyone who looks. One line to drop X-Powered-By; the Railway/Next debug headers are worth trimming in prod too.
The careful robots.txt never declares a Sitemap: directive — and /sitemap.xml 404s (www 301s to the apex, which also 404s). You are telling crawlers the AI usage rules but not handing them the map. Generate the sitemap and reference it from robots.txt.
Happy to re-check free of charge once they are live — the foundation is already tidy.