How could this phone App realistically track me?

Imagine a situation in which I downloaded an App on my rooted Android phone with all permissions enabled, but on this phone:

​

1. There's no SIM Card
2. There's a proxy extension that masks its WiFi connection
3. There's a module that randomizes the IMEI (root)
4. There's a module that spoofs the GPS Location that's fed to the App (root)

Now, in case this App wanted to trace the real location of the phone, and assuming the proxy …

amp android app card extension masks permissions phone privacy proxy root sim sim card track wifi