Avoid hidden files in the home directory (.cvspass, etc.)
Don't store them in the application; multiple users may need them
Put them in ~/Library/ApplicationName directory along with any support files
Or ~/Library/Preferences/ for plist files only
From Java ~ is System.getProperty("user.home")