Do you want anyone to be able to download them or not? If not, when they upload, save it as a random string with no extension, and use php to read it, you can also have .htaccess rewrite any access to the folder/stuff inside to just index. Just store the dataname in the users database.
Or, if you don't mind so much, just store it in the users database, or just use their ID, since that's not changing, it would work fine (I just use ID).