They come in two shapes: one-way, where only one side is disclosing, and mutual, where both are. The clauses that decide whether it is worth anything are the definition of confidential information, the permitted uses, the duration, and the standard carve-outs — information already public, independently developed, or lawfully received elsewhere is never covered. An NDA that defines confidential information as "everything discussed" is usually too vague to enforce comfortably.
The practical view for founders is that NDAs are normal for contractors, employees, vendors and due diligence, and unusual for investor pitches. Most investors will decline to sign one before a first meeting, and asking reads as inexperience rather than caution — they see many similar companies and cannot accept that liability. The protection is also softer than people imagine: enforcing one means proving disclosure and quantifiable harm, which is slow and expensive. Treat it as a deterrent and a signal of seriousness, not a vault.
A concrete example: you hire a freelance developer who will see your pricing logic, customer list and unreleased roadmap. A one-way NDA naming those categories, limiting use to the project, and running three years is entirely appropriate and takes minutes. The same week you meet an angel investor who declines to sign anything. That is standard — so you present the market, the traction and the plan, and keep the specific technical implementation out of the deck.