solve the question of "Where is personal data stored"

Why not instead ask "Why is personal data stored?"

Or

"Why is personal data stored in an accessible method?"

Or even

"Why does the user not encrypt their own data before transmission, have it sent back to them encrypted then decrypted on their system as required"

The answer to "Where do we store personal data" is in /dev/null whenever possible and in a non-accessible encrypted store whenever not possible.

You additionally mention wanting people to contribute their time and code to your projects, what license are they distributed under and will the contributers receive any financial reward for their provided services?