All apps (root or not) have a default data directory, which is
/data/data/<package_name>. By default, the apps databases, settings, and all other data go here. This directory is “private” to the app – which means no other app and not even the user can access data in it (without root permissions).
If an app expects huge amounts of data to be stored, or for other reasons wants to “be nice to internal storage”, there’s a corresponding directory on the SDCard (
Apart from that, all apps can store data anywhere on the SDCard, as there are no restrictions — and many apps do so. They can use directory names freely (and they again do), which is what often makes it hard to decide what all that “junk” on the card is intended for, and what of it can be deleted.
Though, as Tom pointed out, root-apps could store their data almost everywhere on your device, they usually follow the same rules as other apps.
You can find a general explanation of the Android directory hierarchy in my answer here. For your specific question I might add some more details on the
/data/data/<package_name> (and corresponding SD-part):
databases/: here go the app’s databases
lib/: libraries and helpers for the app
files/: other related files
shared_prefs/: preferences and settings
cache/: well, caches
There might be several more directories in this place, or fewer — it all depends on the app. In its own “home directory” (and that’s what it basically is, spoken Linux-wise) they can place files where they want. Usually, these files and directories are only accessible by the app itself (and root, of course) — other than those stored on the SDCard, which are accessible by all apps.