last time I checked Flatpacks have access to the user's home folder by default and save everything there too. I know they made stricter permissions but the defaults are still quite wide.