Seven knobs in the UI, five paths on disk. The tour below follows the settings page top to bottom; if it isn't here, the app doesn't have that knob.

| What | Where |
|---|---|
| Everything persisted: roots, pins, notes, hides, open commands, artifact folders, settings, forge snapshots, your feed | $XDG_DATA_HOME/workspace-welcome/workspace-welcome.db |
| Legacy JSON config: imported once on first boot, never written again; stays as an untouched backup | $XDG_CONFIG_HOME/workspace-welcome/store.json + per-project JSON under $XDG_DATA_HOME/workspace-welcome/projects/ |
| Report HTML cache: disposable, deterministically re-creatable | $XDG_CACHE_HOME/workspace-welcome/reports/ |
| code-server install for the browser IDE | $XDG_DATA_HOME/workspace-welcome/ide/ |
| The app itself | ~/.local/share/workspace-welcome/app (previous version kept at app.bak for rollback) |
On most Linux boxes the data dir is ~/.local/share and the cache is ~/.cache. The store is an embedded sqlite database (transactional writes, WAL journal, no server to run), so a backup is: stop the service, copy the .db file (plus its -wal sidecar if present), start it again. Step 9 of getting started covers upgrade and rollback semantics.
What talks to the network, exhaustively: the forge sync (an explicit, read-only fetch through your own gh CLI, only when you press Sync) and the two on-demand downloads (release upgrades, the code-server install). Everything else is local: scans shell out to git, reads never leave the sqlite file, reports render from cache.
The app is fine on localhost or a trusted LAN. The IDE runs with --auth none, file routes reject path escapes, and the file browser is confined to project subtrees, but none of that makes it a fortress. It is a tool for your network; do not hang it on the public internet and walk away.