Look Back (the "app") does not collect personal data.
Nothing is collected. The app has no networking capability. There is no server, account, sign-in, analytics, advertising, or crash reporter.
Everything stays on your device. The export zip you pick in the Files app is unpacked and organized on the device, and photos, videos, captions, and dates are stored only in the app's private container. They are excluded from iCloud backup unless you turn that on in the app's settings.
The only access is the document picker. The app reads the single file you choose. It does not request photo library, contacts, location, or notification permissions.
Deletion is in your hands. "Delete all imported records" in the app's settings, or deleting the app, removes all data from the device.
No third parties. Because data never leaves the device, it is never shared with anyone.
The app is unofficial and not affiliated with Meta Platforms, Inc. It only reads the Instagram export file format.