You can't ethically do anything based on ideas from this paper until it is made public (by the authors as a preprint, or by the publisher). In particular, before that point you can't refer to the paper, you can't use the ideas without referring to it, you can't publish or otherwise disseminate results based on it, and you can't discuss it with other people, including your collaborators. It can be really frustrating to know something important and be unable to tell anyone else for the time being, but there's no way around it ethically.
The reason is that submitting a paper for publication is not considered to release it for other use or dissemination until it is actually published. The people involved in processing and evaluating it (most notably the editors and reviewers) have an ethical obligation to keep all information about the submission strictly confidential and not to use it to gain any personal advantage. Once it is published of course it can be treated the same as any other paper, and in the meantime the authors can choose to make information publicly available via preprints or talks (in which case others can follow up on this information as appropriate), but nobody else is authorized to release any information before publication beyond what the authors have chosen to share, or to use it for any purpose other than reviewing the paper. Otherwise it has the same ethical status as using material you stole off the authors' desks.
There's no reason why the research community has to work this way in principle, but it's the system that has evolved over time. (Note that as recently as the 1930's, famous physicists were not all in agreement as to how peer review should work.) It's possible that in the future we will move to systems such as submitting for publication only after releasing a preprint. That seems to be the trend in some fields, but we haven't yet made a full transition if we ever will, and the community's ethical principles still offer protection to authors who choose not to distribute their paper before publication.
Nobody signs a non-disclosure agreement when reviewing a paper, but the ethical principles are well established. Deliberately violating them would be a serious form of misconduct, which could easily be career-ending if it was more than a minor or technical violation.
Pete L. Clark asks in the comments whether referees are allowed to prepare follow-up papers, as long as they don't distribute them before the original paper becomes public. I.e., does the "you can't ethically do anything based on ideas from this paper" really mean you can't do anything, or just that you can't disseminate anything yet? (Let's assume it's a single-authored paper that is not discussed with anyone else in advance.) My interpretation is that nobody can stop you from thinking a little, and you may not even be able to stop yourself, but actively working on and writing a paper of your own would be abusing your position as referee. There probably isn't a consensus as to exactly where the line is for what's strictly forbidden, but either side of the line could still look terrible. If you want to publish work you began thinking about as a referee, I'd strongly recommend against doing it so quickly that's it clear you had to have known about the original paper in advance.
