It's usual for package management tools to leave files in the home directory alone, so that user preferences, etc. are retained on reinstallation. You can choose to delete them if you wish, but I wouldn't expect flatpak (or any other software installation tool) to delete configuration files in my home directory. And that's what ~/.var/app is, looking at the example in the flatpak wiki:
.var/
└── app
└── org.gnome.GEdit
├── data
├── config
└── cache
~/.local/share/flatpak/repo/refs/remotes/org.flatpaklinux.Suphead-origin looks like it's part of flatpak's state, and it could be using it to track it what it had installed and where from (such data is also often kept around after package removal, and anyway they don't occupy much space). From the flatpak wiki:
Flatpak uses OSTree to distribute and manage applications and
runtimes. The repo/ in the above tree is the local OSTree repository.
Flatpak creates the active/ directories of applications and runtimes
as symlinks to OSTree checkouts (in the same directory). Using OSTree
has the advantage that the checkouts are automatically deduped and
share diskspace, since OSTree is using hardlinks and content-based
addressing. OSTree also makes it easy to roll back to an earlier
version, should the need arise.
refs/remotes/org.flatpaklinux.Suphead-origin looks very like something from a Git repo:
$ cat .git/refs/remotes/origin/master
73dad27c1c047c159f0ee22d6627af5bfdf4dbfc
If that is indeed the case, then that file just indicates which commit of the remote source was at the last time you fetched something from there.
If you think flatpak is taking up too much space even after removing an app, check the output of flatpak list -d --app --runtime to see what apps and runtimes are still installed and the space they take.
