iOS - Which user data are apps able to collect by default?
It might be simpler to approach this from the perspective of what info iOS developers must explicitly ask the user for permission.  If it's not included in this list then the user must assume a developer can access that info without asking the user for permission. 

As an iOS developer for a few years, I know that Apple locks-down almost all user info. I can access very generalized info such as the device you're using, model number, but I can't tie it to a specific person unless I ask your permission first. 

My goal, and hope, is that others will [edit] and add to this answer as more info is found/discovered/released. 

Source for the quote below is from Apple's developer docs. 


  Data protected by iOS system authorization settings includes location,
  contacts, calendar events, reminders, photos, media, and many other
  types as well.


That's pretty broad but it gives you an idea about what developers can't access without asking your permission first.  Here's another list from that same document that indicates the data and resources protected by system authorization settings:


Bluetooth peripherals
Calendar data
Camera
Contacts
Health data
Health sharing
Health updating
Homekit 
Location 
Microphone 
Motion
Music and media library 
Photos
Reminders
Siri
Specht
TV provider