The private key never leaves the one it belongs to - if it does, then the encryption isn‘t secure anymore. If keys are sent, then the public ones, which are ‚public‘ (e.g. let me send you my public key, so you can send encrypted messages to me).

When you create a key pair, you get which the private and which the public one is. Keep your private key, private and you‘re the only holdener.

For advanced security, the messages (e.g. E-Mails) are secured on top with TLS, which encrypts the message on its way. If there‘s a man-in-the-middle attack, he would just see the encrypted message with no key to decrypt it.