It is designed for use as a data store for standalone applications, and not as the database behind a multi-user distributed client system. In addition, it is reported to has some issues with transaction isolation. Per wikipedia, "HSQLDB version 1.8.1 supports transaction isolation level 0 (read uncommitted) only. It means a SQL query in one session might occasionally fetch uncommitted data from another session."
IMO, if you don't care about the data, put it wherever you like. If you DO care about it, if data has some value, make it secure - put it in a database server, and build your application atop a solid database foundation.