Yes. You get a chance to define in your NDA what exactly is protected under the non-disclosure and for what period of time. Normally, this covers what is defined as that business' proprietary information and how you will keep it, destroy it, and notify them of destruction at a later date.
It shouldn't cover the entire code, just the parts of it that are proprietary to the business' needs and whatever proprietary things you learned about the business while working for them. You might want to keep the parts of the code that are proprietary under NDA forever, but things about their business operations only for 3 years.
Later when you negotiate the contract and/or purchase orders, those will include the NDA by reference. You will have a clause in your contract that states whether the entirety of the code is theirs or whether only parts of it are. I know developers tend not to start from scratch so you want to be careful not to sell something that isn't yours to sell - and not cover it under NDA.
I can take a look at the NDA they sent you and help you figure it out if you want.
The NDA usually never expires. You can't share the information you learnt from them.
Some put 3-5 years of expiration time, that is a normal time for a business to loose the niche.
The NDA may also include things like that you can't hire employees of your employer, and you should also ask the same thing for your employees.
Some also include the property of your source code. This is not mandatory for n NDA.
I do a lot of these agreements. Usual practice depends on the information to be disclosed -- how long is it going to be commercially useful?
Between companies, 5 years is a fairly common term, with 10 years being a really long term.
With individuals engaged as independent contractors or employees, the term is often perpetual. That, however, is largely because the employer wants to be able to sign its own NDAs, and not worry about signing onto a longer term than its people are good for.
Another thing to worry about is: what happens when that term is over? Some NDAs require you to return information at the end of the term. I find this term to be silly -- 5 years later, I'm supposed to remember to do that? So, usually, I say "return information upon request." That puts the onus on THEM to ask for it back.
I'd ask for maybe 3 years for expiration.
Any non-compete provisions in the NDA have to be limited by time- maybe a year.