Thanks for your thoughts everyone. We have a lot of roles already so I'm a bit loathe to add more, for a workaround, essentially.
I do like the json file in assets, but even if the risk is small, those files are public, so could technically be found? Considering I'm planning to store user data I'd rather avoid that.
Guess I'm down to using a custom metadata field linked to community or a user account.
If you're wanting to store the data in the plugin, but don't want it publicly accessible, you could just store it directly in a custom component and then include/import that custom component as needed in your code. If you're working with the Plugin SDK, you could perhaps even build some automation around this to simplify your process.
If you need to update the data on the fly in production (without going through Studio Self Publish), I agree that a custom setting is the best way to store this data. Though the idea of posting to a private board is a clever work-around, and one I've seen leveraged before for similar purposes!
I saw you mentioned not having access to a separate server, but for anyone else with a similar use case in the future, leveraging the http.client context object via Freemarker might be an option to pull in the data as needed. Just be aware that you can only use this context object in Page Initialization (Common.init.ftl) and Endpoints, and you need to be careful about Page Initialization since the call is blocking and could thus slow down your page loading when executed.
