Debian: What happens to /var/lib/<package> when a package gets updated?

Question

Is it safe to keep data (such as uploaded files for a web application) in /var/lib/<package>? Won't it get overwritten when the package gets updated?

OS: Ubuntu
The package installed via apt-get install <package>

Answer 1

dpkg does not overwrite files it did not install in the first place.

If you purge a package, everything marked as a config file will get removed; this is usually not done using a wildcard, so even then, files you installed outside of dpkg will probably be kept.

As to whether it is a good idea to keep uploads in /var/lib is questionable; something like /var/cache would seem less haphazard, but check the FHS for precise details.