Hi, Coral is a web based app, just like Touch Stay (which I am a founder of).
All web based apps are accessible to anyone who has the link. Think of them like a regular website address. For example, here's a link to a Touch Stay example: qr.touchstay.com
However... there is a second option. Subtly different. Coral (like Touch Stay) gives you the option to set an expiry date on the link. For that you enter the guest email and the dates of stay. It then sends a link which expires at the check out date.
Both options are public links that could be accessed by anyone who has the link (i.e. your guest could forward to others in their group). The advantage of the 2nd option is that it expires at check out. The 1st option doesn't.
Hope that was useful. Even though I'm a Coral competitor the solutions work in the same way.