I don’t collect any more personal data than I have to. If you leave a comment, I collect the comment (duh!), plus your IP address. If you join a mailing list, I collect your email address.
WordPress sets cookies in your browser if you don’t prevent it, but that’s for your convenience: it doesn’t tell me anything.
My Apache HTTP server logs HTTP transactions in a boring and impersonal way for boring and impersonal debugging.
The Helpers
Since I wrote the above, I’ve hired a few robots. They see more than I do, so you should know about them.
Google Analytics (via the MonsterInsights plugin) tells me how many people visit and which pages they read. To do that, it sets cookies and sends Google information about your visit, such as the pages you view, your browser and device, and roughly where you are. I look at the totals. Google does whatever Google does; its own privacy policy covers that.
Akismet keeps the comment section from drowning in spam. When you leave a comment, it sends the comment along with your name, email, IP address, and browser information to Automattic, the company that runs Akismet, so they can decide whether you’re a person or a bot.
Wordfence is a security plugin. It watches traffic to the site, logs visitors’ IP addresses and what they request, and blocks things that look like attacks. If you’re not trying to break in, it’s just keeping a boring and impersonal log, like Apache.
That’s about it.