If not client, what other 'magical place' do you expect it to be at?
OSRS client itself collects and sends this information to server:
os arch
os name and version
java vendor
java version
number of processor cores available
maximum heap size (even this can get you flagged, because official clients usually have a maximum heap size explicitly set to 256m)
Then there's also the random.dat file, which is used for various purposes including tracking and linking accounts of the same owner.
The way it works is quite simple, it's simply just a randomly generated 192 bit unique number that get's sent on login, if such file does not exist client creates it.