It might be worth looking at the Filesystem Hierarchy Standard which describes what the various filesystems are generally for (from a standards perspective, not everyone has to follow it), which will let you know where personalised data might be stored. However, the short answer is - anywhere an application wants to store it, and has permission to store it.
Generally, non-admin users only have write access to /tmp/
, /home/user
, /var/tmp/
, some directories in /run/
(/run/lock and /run/shm for example).
However, the mail daemon and the print daemon, which could in theory be used to store personalised data in files, if only temporarily, have write access to locations in /var/spool/
. Syslog could in theory store personal information, depending on how users interact with the system and hence there could be content in /var/log/
.
None of that covers other products which might be creating data in other locations (/opt/
, /srv/
, anywhere else they're configured to do so).
Doing it piecemeal is going to be complex.
NB: There's a summary of the FHS on Wikipedia.