The application object is the logical place to store data that needs to be shared by all components in all sessions of an application. Application state is typically stored in the application object's instance variables. Sessions can use the WOApplication application class or static method. If you're implementing direct action request handling, the only type of  state you store by default is application state. Session objects are not  created unless specifically requested, and components and WODirectActions do not persist between cycles of the request-response loop.
Application state persists for as long as the application is running.
If your site runs multiple instances of the same application, application state must be accessible to all instances. In this case, application state might be best stored in a file or database, where application instances could easily access it.