A simple Strava widget for WordPress
No. The Simply Strava settings page uses the username and password once to obtain an access id and token from the strava webservice. The username and password are not stored by the server, but your browser may save them.
The Strava access id and token are suppose to be valid forever, but in some cases they may time out. If that happens, go back to the settings page and enter your username and password again and autopoulate a new id and token. Don't forget to save the settings after you autopopulate.
Strava's API returns times in your local timezone, but currently there is no way to identify programatically what that timezone is.