What privacy sensitive metadata does an APK package contain? What information possibly sensitive information is included in apk files?
The obvious metadata are of course the fields in the signing certificate. But what about (absolute) file paths, user names used on the machine where the apk was built and similar information?
APK files usually don't contain much of that data unless the developer explicitly has added them or used unusual third party programs to edit resources contained in the app e.g. images. You can simply check that by unzipping an APK file ready to be released. Use full text search tools on all unzipped files and search for data you consider sensitive.
If you want to minimize unnecessary data I would recommend to use a virtual machine with e.g. a minimal Linux installation you where the installation itself does not contain any sensitive data. As Android apps can be built easily using Gradle on command-line you don't even need a UI. Use it to build the final APK file and copy it to the host OS.
Examine the created file as described at the beginning and if you don't find anything it is ready for release.