This document proposes a personalized web search (PWS) framework called UPS that protects user privacy during search. UPS can generalize user profiles to different levels based on privacy requirements while balancing personalization utility and privacy risk. It presents two greedy algorithms, GreedyDP and GreedyIL, for runtime profile generalization and an online mechanism for deciding when to personalize queries. Experiments show UPS effectively protects privacy while maintaining personalization benefits and GreedyIL outperforms GreedyDP in efficiency.