http://repo.xposed.info/module/biz.bokhorst.xprivacy
It filters permission requests so when an app tries to use one, it gives you a popup with allow/deny temporarily/permanently options, so if an app wants to access something it shouldn't (location, contacts, device ID, etc.), you can feed it empty/fake data transparently to it.