You should consider putting user settings in ./data/ anything in ./ will get overwritten by the updater. Whether you store settings in XML, JSON or just use a required lua script is up to you.