You're connecting to
tcp my.server.com:5000, it runs ssh subsystem "app" there. What is being performed is defined by that subsystem (in the ssh server config file). That subsystems could transfer data forth and back, via stdin and stdout. External adversary sees tcp connection, sees that this is ssh session and nothing more. This is not called "ssh tunneling".
Tunneling is when you forward some TCP socket like this:
ssh firewall -L 12345:system-behind:54321, then locally connect to
localhost:12345 and it works like you are sitting on firewall and connecting to
system-behind:54321 from there. You "tunnel" tcp connection via ssh. By adding -g you can allow anybody in your network to connect to
you:12345 and be like connected to
system-behind:54321 from firewall.
For example, consider Linux firewall doing NAT and with ssh server, and some windows server behind, which has firewall, that allows connections only from local network. You could connect there like this:
ssh firewall -L 13389:windows-server-address:3389 and then
xfreerdp /v:localhost:13389; server will see connection from local address of firewall, not from your internet address.
You could do this in reverse way with
ssh remote -R 12345:system-near-you:54321. Then you open socket on remote, and someone sitting on remote could connect to
localhost:12345 and end up connected like they are sitting on your machine and connecting to
system-near-you:54321. This is reverse tunneling. Again, -g allows this not only to those who sits directly on remote, but to anyone who could connect to
There is also ssh ip tunneling, when you create virtual tunnel interfaces both on server and client, assign there ip addresses and connect them with ssh. This is called VPN, but when doing it with ssh machinery is not very convenient, and I've never seen this in use.