Personalized web search has improved search quality but users are reluctant to share private information, limiting its proliferation. The paper proposes a framework called UPS that generalizes user profiles during queries to balance personalization utility and privacy risk exposure, as specified by the user. UPS uses two greedy algorithms, GreedyDP and GreedyIL, for runtime profile generalization, and an online predictor for personalizing queries. Experiments show UPS effectively protects privacy while maintaining personalization benefits, and GreedyIL outperforms GreedyDP in efficiency.