The identity graph — how Turtini recognizes you across vendors

Every Turtini user has an identity graph — the list of every email, phone, and handle the platform knows belongs to you. It's the spine that lets the platform recognize "this person who just signed up as a customer of Vendor B is the same human who already has an account from Vendor A."

What gets added to your graph:

• Your primary sign-in email (always — flagged as 'primary')
• Your personal/recovery email once you've verified it
• Every email from an account that's been merged into yours (flagged as 'merge')
• Any verified phone number you've claimed (flagged as 'manual')
• Future: handles you claim explicitly via the Identities settings page

What the graph powers:

• **Auto-linking** — when a vendor org adds a Contact with your email, the platform stamps `linkedUserId` on that Contact pointing at your canonical user. You see that vendor's invoices, quotes, and chats inline on your Personal Home immediately — no "follow this vendor" step.
• **Personal-email login** — typing your verified personal email on the Login page signs you into your canonical account, even though Firebase Auth's record is keyed on a different email.
• **Account merge matching** — the daily scan + on-save trigger look for new identity overlaps and propose merges.
• **Safety mesh canonicalization** — a banned actor recreating with a new email is still recognized as the same human once any of their identities resolves through the graph.

Privacy guarantees:

• Only verified identities power sign-in lookups — unverified personal emails are never enumerable.
• `identities[]` is server-only — clients can't add an identity directly. Verification flows hit a Cloud Function that double-checks ownership before appending.
• If an identity is already verified on a different account, the system refuses to attach it to yours — an admin contact resolves the conflict.

You can see your current identity graph in your Account settings → Identities section. Each entry shows the source (primary / recovery / merge / manual), addition date, and verification date.