if you've full control over the odoo installation and you can make sure that module folder is writable, or using this as private solution, then creating files in the module directory is ok. But, if you're going to ship module, then it's NOT guaranteed that the module directory will be writable for odoo server instance. most probably, often it will not. for example for security reasons or when installed from .deb package... whereas, there is a "Data Directory", which is guaranteed to be writable to odoo server instance. Inside your module code, you can gather path of data directory as follows:
from openerp.tools import config
path_to_data_directory = config['data_dir']
Under Data Directory, there is a folder named "filestore" which is used to store files uploaded/stored with "ir.attachment" model (BTW, it's also option to use ir.attachment model in order to store new files, if applicable it's recommended to use it, there is nice implementation of filestore, avoiding duplicated files, etc, etc...). Conventionally we can add another folder, say "custom_filestore". also it may be meaningful to use database names under it, as it's under filestore directory, and module name as well(?)... then, path to a directory where we can save files, may be acquired like:
return os.path.join(config['data_dir'], "custom_filestore", "module_name", self.env.cr.dbname)
this way, you'll have separated folders in case of multiple databases. also, target directory will be always writable (worth to note, that directory itself may not exist for the moment, but the location will be always writable to the odoo server instance, whereas it's not guaranteed for module directory itself).
take look at how is filestore path calculated in original filestore implementation, you can see here