Credentials are stored locally in data/config.json on your server. Never transmitted anywhere except directly to Garmin Connect.