Anonymous / guest user
A temporary but usable account that saves someone's work before signup and becomes their real account when they add a login.
What it is
An anonymous or guest user has a real internal ID and session before they provide a login method. Their cart, draft, game progress, or preferences can be stored against that ID, then kept when they add an email, passkey, or social login. Firebase Authentication calls this anonymous sign-in and supports linking a credential to the same user.
Reach for it when signup would interrupt the first useful action. The upgrade should attach credentials to the existing identity rather than copying data into a brand new user, so URLs, ownership, and progress do not jump underneath the person.
Guest does not mean trusted. Limit expensive or abusive actions, set a cleanup window for abandoned accounts, and make recovery expectations clear because a cleared cookie can strand the data. The hard case is upgrading with a credential that already belongs to another account: stop and run an explicit merge flow instead of silently choosing which history wins.
Ask AI for it
Add guest accounts with Firebase Authentication. Call signInAnonymously before the first saved action, store all guest-owned data under auth.currentUser.uid, and enforce that UID in Firebase Security Rules. On signup, use linkWithCredential on the current anonymous user so its UID and data survive. If Firebase returns auth/credential-already-in-use, require sign-in to the existing account and show an explicit merge review instead of overwriting either side. Rate limit guest-only actions, mark guest records with created_at, and run a scheduled cleanup for abandoned guests after 30 days while preserving any account that has linked a credential.