My question is if I deploy a contract online, say for example, a contract that represents a loan between Mary and Peter. How much would someone see who tried to decode the block? Is it correct to say that any variable that is public would be visible in hex (so visible as text after decoding)? What about private variables? How about function code itself? Can you store data in the blockchain such that it is not readable?
A smart contract cannot store data in the blockchain in such a way that it is not readable.
The execution flow of every call to a smart contract function can always be seen by everyone. All variables (both public and private) can be read by anyone. All code can be read by anyone. Everything directly stored inside the blockchain is public.
The only way to store secret information in the blockchain is to encrypt it before passing it to the smart contract.