They sign in with that exact Google/email address. Remove anytime — their existing data stays, but they can't create new content.