What does an app actually know about your location?
Frequently far more than the permission dialogue implies, because location is inferred from many signals, not only from satellite positioning — and denying the location permission does not stop all of them.
The direct sources:
Satellite positioning, accurate to metres outdoors.
Wi-Fi networks nearby, matched against enormous databases of network identifiers and their known positions. This works indoors and is frequently more accurate than satellite in cities — and a scan does not require you to connect to anything.
Cell towers, giving coarse position.
Bluetooth beacons, used in retail for in-store positioning.
The indirect sources that survive a denied permission:
Your IP address, giving city-level location and sometimes better.
Photo metadata, if images carry coordinates.
What you tell it — delivery addresses, tagged places, saved locations, the language and time zone on your device.
Social graph, since who you interact with is location-correlated.
Why it matters. Location history is uniquely revealing: it identifies your home and workplace within days, and reveals religion, health, relationships and political activity through the places visited. Research has repeatedly shown that a few location points are enough to identify an individual uniquely in supposedly anonymised datasets, which is why "anonymous location data" should be read sceptically.
Where it goes. Beyond the app itself, embedded advertising and analytics software in many apps transmits location to third parties. A substantial commercial market exists in aggregated location data, and it has been the subject of repeated investigations and enforcement.
What actually helps:
Grant location only while using the app, never always, for anything that does not genuinely need background access.
Use approximate location where the operating system offers it — enough for weather, useless for tracking.
Turn off background app refresh for apps that do not need it.
Review which apps have background location periodically; the list is usually surprising.
Strip metadata from photos before sharing.
Reset your advertising identifier and opt out of tracking where offered.