Local customer release candidate

Customer access, clearly separated.

Apple and Google sign-in are not configured in this local candidate. Their buttons do not start a provider session. The separate local fixture launcher creates fictional backend test sessions, not provider consent. Use fictional details only; do not enter passwords, provider credentials or real customer records.

Account and access

The existing customer backend owns identity mappings, customer sessions and the records each account may access. A provider identity and a record-access grant are separate. Matching email addresses, including Apple private relay addresses, do not merge accounts or authorize access. Selecting an existing-Turnilo preference records intent only.

Local session behavior

The local candidate uses a separate HttpOnly customer session cookie. The browser keeps the current session’s CSRF value in memory for permitted profile changes and sign-out; no provider token is placed in localStorage or sessionStorage. Signing out revokes the customer session. It does not sign into or grant internal staff access.

Only explicitly shared customer record projections are displayed. Invoices and checkout remain unavailable. The UI clears previous customer rendering when refreshing access or losing the session.

Before public release

Provider credentials and domain/callback configuration, the verified Turnilo source bridge, final privacy and retention terms, and production release review are still required. This page describes local test behavior; it is not a claim of legal clearance, provider verification or live availability.

Questions: get@frshcreative.com. For public inquiry handling, see inquiry privacy.