Application can write to /home/user/.private and can only see and access their own stuff written in there.
The .private directory is automatically hardware-encrypted by Aegis (Aegis has a good side, too).

To make this really secure, the application storing / accessing your data should ask for a password or passphrase that is stored encrypted with Aegis as well.