sharing-service/data

This is where data files will go. The web server user (eg: www-data) needs read/write permissions on this folder - web client user does not.

You can place it elsewhere by using a symlink or virtual directory (which is probably easier to secure)