diff --git a/apps/web/index.html b/apps/web/index.html
index ee57059..76272f1 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -15,6 +15,19 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <meta name="description" content="PIG — Prime Intellect Growth. An agent-native CRM for two-sided AI-compute companies." />
 
+    <!--
+      Not public yet. noindex keeps the app out of search results; noarchive
+      and nosnippet stop a cache or excerpt surviving after it is removed.
+      Mirrored by /robots.txt and by an X-Robots-Tag header in Caddy — see the
+      comment in robots.txt for why all three exist.
+
+      Note this deliberately does NOT strip the og:/twitter: tags below. Link
+      unfurlers are not crawlers: they fetch on behalf of the person pasting
+      the link, and a card is exactly what we want when this is shared with
+      Prime Intellect.
+    -->
+    <meta name="robots" content="noindex, nofollow, noarchive, nosnippet" />
+
     <!-- Matches the app chrome so Safari's toolbar blends rather than banding. -->
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
     <meta name="theme-color" content="#09090b" media="(prefers-color-scheme: dark)" />
diff --git a/apps/web/public/robots.txt b/apps/web/public/robots.txt
new file mode 100644
index 0000000..2dd1d1c
--- /dev/null
+++ b/apps/web/public/robots.txt
@@ -0,0 +1,17 @@
+# PIG is not public yet. Nothing here should be indexed or crawled.
+#
+# This is a request, not enforcement — well-behaved crawlers honour it, and
+# hostile ones do not. The real gate is authentication: every route below /
+# returns the sign-in screen to an unauthenticated visitor and every /api/
+# route returns 401. This file exists so the app does not accumulate a search
+# footprint before it is meant to have one.
+#
+# Backed by an `X-Robots-Tag: noindex, nofollow` response header in the Caddy
+# config and a <meta name="robots"> tag in index.html. The header is the one
+# that matters most: it also covers og.png, the manifest and anything else
+# served that is not HTML.
+#
+# To go public: delete this file, remove the meta tag, and drop the header.
+
+User-agent: *
+Disallow: /
diff --git a/deploy/Caddyfile.example b/deploy/Caddyfile.example
index e3557f1..7b84732 100644
--- a/deploy/Caddyfile.example
+++ b/deploy/Caddyfile.example
@@ -20,6 +20,11 @@ primeintellectgrowth.com, www.primeintellectgrowth.com {
 	# IMPORTANT: editing that script changes its hash and CSP will silently
 	# block it. The browser console says exactly which hash it wants.
 	header {
+		# Not public yet. The header covers everything served — og.png, the
+		# manifest, the built assets — where the <meta> tag in index.html only
+		# covers the HTML document. robots.txt asks crawlers not to fetch;
+		# this tells the ones that fetch anyway not to index.
+		X-Robots-Tag "noindex, nofollow, noarchive, nosnippet"
 		Strict-Transport-Security "max-age=31536000; includeSubDomains"
 		X-Content-Type-Options "nosniff"
 		X-Frame-Options "DENY"