State: are they permanent? I'm using StateAPI to store some variables that shouldn't be exported as configurations.

These values are stored in the database, in the key_value table.

Is this a "secure" table? Are there tasks (cache-clear or other) that could automatically remove values from this table? 

Is it a good idea to create a custom form to let users to set some states?
They could be simple strings, or url, and I think that create nodes for this information is too "heavy".
Is this a "secure" table?


Depends on what you mean by secure.


  Are there tasks (cache-clear or other) that
  could automatically remove values from this table?


No.


  Is it a good idea to create a custom form to let users to set some
  states?


This is kind of looking at it from the wrong direction. States are a solution to an issue. If you have something that is to be stored, for which states are a good solution, then they are good to use. In other words, if you have a form that does something that states would be good for, then use states. Deciding to use states then creating forms for them doesn't really make sense.