I've been astonished at the number of apps that are grabbing my location in the background. Espescially since I previously considered myself to be quite on top of the permissions I'd granted my apps.
Android for work can reduce privacy leaks; get Island or another app to set up a work profile on your Android phone, and sign into a secondary account on it so it doesn't have your contacts. Now go to settings and disable location access for work apps. I've stopped paying attention to whether or not apps request location data or contacts access for to this. To prevent the apps from running in the background, just turn off work profile when not using it (or look up Greenify's deep hibernation).
Being on a stock, unrooted phone, the thing I miss most is xprivacy's prompts whenever an app wants to use a permission. I just make sure to check my permissions list every month or so to make sure Google hasn't silently allowed an app update to enable new permissions.
