Where are original photos and thumbnails stored?

WebAsyst Photos stores original images in subdirectories inside directory data/ which is protected from direct HTTP access. Such full size images can only be downloaded using special URLs generated by PHP script. A link for downloading original images can be retrieved either in the account backend if you have appropriate access rights to the specific album, or from the publicly accessible photo galleries where the "Can view and download original images from public gallery" option is enabled. Such a link is virtually uncrackable (as it would require "guessing" a 32 character long hash code).

Image thumbnails are stored in subdirectories inside directory published/publicdata/ which is directly accessible via HTTP (i.e. with a browser).

For each album a separate subdirectory is automatically created both in data/ and in published/publicdata/, in those subdirectories images belonging to that specific album are stored. When you move images from one album to another, image files are physically moved between subdirectories on the server.