Exodus has a list of applications with known spyware libraries: https://reports.exodus-privacy.eu.org/en/reports/list/. The homepage has search and also lets you re-analyze applications if there's no report or it's out of date.

There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.

Don't use apps. Use your browser and an ad blocker.

In Android apps need to request location permission. You can reject it and/or uninstall those which request it.

Most apps will only be able to request location while running in the foreground.

Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.