The default location for the index data is the $HOME/.recoll/xapiandb/ directory. This can be changed by setting the RECOLL_CONFDIR environment variable, or by specifying the dbdir parameter in the configuration file (see the configuration section).
The size of the index is determined by the size of the set of documents, but the ratio can vary a lot. For a typical mixed set of documents, the index size will often be close to the data set size. In specific cases (a set of compressed mbox files for example), the index can become much bigger than the documents. It may also be much smaller if the documents contain a lot of images or other non-indexed data (an extreme example being a set of mp3 files where only the tags would be indexed).
Of course, images, sound and video do not increase the index size, which means that it will be quite typical nowadays (2006), that even a big index will be negligible against the total amount of data on the computer.
The index data directory (xapiandb) only contains data that will be rebuilt by an index run, and it can always be destroyed safely.
The Recoll index does not hold copies of the indexed documents. But it does hold enough data to allow for an almost complete reconstruction. If confidential data is indexed, access to the database directory should be restricted.
As of version 1.4, Recoll will create the configuration directory with a mode of 0700 (access by owner only). As the index data directory is by default a sub-directory of the configuration directory, this should result in appropriate protection.
If you use another setup, you should think of the kind of protection you need for your index, and set the directory and files access modes appropriately.