The reason for not storing data in /cgi-bin/, or in the document root in general, is that a simple mis-configuration can easily expose that data to the general public.

So either use a database as marto suggested, or store it somewhere completely different, like /var/data/, or in the home directory of the www user.