Security fix & breaking change
Prior versions had the author's Resend API worker URL and secret baked into the compiled .pbw, causing all users' activities to be emailed to the app author's inbox. This release fixes that.
What changed
- Config page now has a new Email field — enter your own email address and your GPX files will be sent there after each activity.
- The Cloudflare Worker now sends to the email supplied in each request instead of a hardcoded server-side address.
- The worker no longer needs a USER_EMAIL secret.
Migration
1. Update both the .pbw and the Android companion APK — AppMessage key numbering changed and the two must match.
2. Open Pebble app settings and fill in the new Email field.
3. If you self-host the worker, redeploy it and delete the old USER_EMAIL secret.
Release notes for v1.9.0:
- GPX now always saved to phone Downloads — no server required
- New Download subfolder setting to organise files (e.g. pebble-strava/)
- Status bar cleaned up: worker indicator (W✓/!) only shown when a worker URL is configured
- Renamed to Strava GPX to better reflect the core feature