All data is send directly to Twitch to make sure no other third-parties receive any information. When a change happens due to in-game activity an update message is sent to the Twitch PubSub Service. This message is used to update the extension for the current viewers. General documentation about Twitch Extensions can be found here.
It is worth noting that the token retrieved from Twitch to authenticate this plugin can only access features related to the extension. Twitch did a good job in preventing extensions and their tokens to have access outside of the extension (like controlling your Twitch account).
To give you an idea how your data is being sent to the viewers:
To simplify the state management one large state object is being send to Twitch. However, the Twitch Configuration and PubSub Service only allow messages of a maximum size of 5KB. This is also the reason why you can see the bank and collection log incrementally grow bigger for viewers. They are sent over in smaller parts and merged together later. All messages are compressed using a GZIP compression algorithm to maximize the use of available bytes.
The state updates are dependant on the maximum amount allowed by Twitch. Rate limit documentation can be found here. Currently the maximum update frequency is is once per two seconds. This means the updates are never truly 'real-time'.
The plugin is implemented with the OSRS weekly updates in mind. There are few dependencies on specific content meaning that almost all updates are directly reflected in the plugin as well. For example external item caches are used to make sure item icons and names are directly up to date. This allows for lower maintenance of this plugin and less down-time or faulty behaviour.
This also works for the collection log. A thing to note here is that if you want any new collection log items shown you need to open the collection log interface at that boss / category at least once.