I got like a feeling that WhatsApp works by making use of public keys and private keys encryption.
That's correct, WhatsApp uses Curve25519.
My question is, where would the private key of this recipient be stored, like within their account?
The keys are generated client-side, so they should be stored on your phone.
Also, how would the whole key thing work in a WhatsApp group as there are multiple users involved?
According to their paper:
Traditional unencrypted messenger apps typically employ “server-side fan-out” for group messages. A client wishing to send a message to a group of users transmits a single message, which is then distributed N times to the N different group members by the server.
This is in contrast to “client-side fan-out,” where a client would transmit a single message N times to the N different group members itself.
The exact procedure
The first time a WhatsApp group member sends a message to a group:
The sender generates a random 32-byte Chain Key.
The sender generates a random Curve25519 Signature Key key pair.
The sender combines the 32-byte Chain Key and the public key from the Signature Key into a Sender Key message.
The sender individually encrypts the Sender Key to each member of the group, using the pairwise messaging protocol explained previously.
For all subsequent messages to the group:
The sender derives a Message Key from the Chain Key, and updates the Chain Key.
The sender encrypts the message using AES256 in CbC mode.
The sender signs the ciphertext using the Signature Key.
The sender transmits the single ciphertext message to the server, which does server-side fan-out to all group participants.
The “hash ratchet” of the message sender’s Chain Key provides forward secrecy . Whenever a group member leaves, all group participants clear their Sender Key and start over.
Important here is point number 4:
The sender individually encrypts the Sender Key to each member of the group, [...].
If you need even more details then you can click here to download their whitepaper.