Digital identity is fundamental for accessing mobile applications and managing user attributes. However, existing centralized identity management solutions rely on third-party operators, posing privacy risks and limiting user control. The decentralized solutions seek to address the issues but often fall short in privacy preservation, efficiency, and cross-application compatibility. In this paper, we propose PPUgIM, a user-governed identity management scheme with universally composable security, emphasizing privacy and data sovereignty in distributed mobile applications. PPUgIM introduces a DID-like account equipped with multi-attribute credentials, enabling users to autonomously manage and selectively disclose various identities without revealing sensitive information. An enhanced authenticated data structure is designed based on vector commitments, supporting short and constant-size proofs for efficient batch authentication of attribute credentials. Furthermore, a formal security analysis of PPUgIM is conducted, and a prototype implementation is developed for performance evaluation. Results show that credential generation takes 500 ms, verification 110 ms, with a constant size proof of 0.15 KB. Proof overhead for identities is reduced by 38.1% compared with existing schemes, demonstrating PPUgIM’s practicality in real-world distributed mobile applications.