diff --git a/server.py b/server.py
index cd40e0f..fe2abc5 100644
--- a/server.py
+++ b/server.py
@@ -318,6 +318,52 @@ async def submit_form(slug: str, body: dict, request: Request):
 async def submit_legacy(body: dict, request: Request):
     return await submit_form("default", body, request)
 
+# ---- Check Order Status (no password) ----
+
+@app.get("/api/status")
+def check_status(email: str = "", phone: str = ""):
+    if not email or not phone:
+        raise HTTPException(400, "Email and phone are required")
+    db = get_db()
+    rows = db.execute("""
+        SELECT s.id, s.created_at
+        FROM submissions s
+        JOIN submission_data d1 ON d1.submission_id = s.id AND d1.field_label = 'Email' AND d1.field_value = ?
+        JOIN submission_data d2 ON d2.submission_id = s.id AND d2.field_label = 'Phone' AND d2.field_value = ?
+        ORDER BY s.id DESC LIMIT 1
+    """, (email.strip(), phone.strip())).fetchall()
+    db.close()
+    if not rows:
+        raise HTTPException(404, "No submission found with that email and phone")
+    r = rows[0]
+    return {"id": r["id"], "created_at": r["created_at"], "status": "received"}
+
+# ---- Delete Submission (verify with email + phone) ----
+
+@app.delete("/api/submission")
+def delete_submission(email: str = "", phone: str = ""):
+    if not email or not phone:
+        raise HTTPException(400, "Email and phone are required")
+    db = get_db()
+    rows = db.execute("""
+        SELECT s.id
+        FROM submissions s
+        JOIN submission_data d1 ON d1.submission_id = s.id AND d1.field_label = 'Email' AND d1.field_value = ?
+        JOIN submission_data d2 ON d2.submission_id = s.id AND d2.field_label = 'Phone' AND d2.field_value = ?
+        ORDER BY s.id DESC LIMIT 1
+    """, (email.strip(), phone.strip())).fetchall()
+    if not rows:
+        db.close()
+        raise HTTPException(404, "No submission found with that email and phone")
+    sub_id = rows[0]["id"]
+    db.execute("DELETE FROM submission_tags WHERE submission_id = ?", (sub_id,))
+    db.execute("DELETE FROM reply_drafts WHERE submission_id = ?", (sub_id,))
+    db.execute("DELETE FROM submission_data WHERE submission_id = ?", (sub_id,))
+    db.execute("DELETE FROM submissions WHERE id = ?", (sub_id,))
+    db.commit()
+    db.close()
+    return {"ok": True, "deleted_id": sub_id}
+
 # ---- Admin Submissions ----
 
 @app.get("/admin/submissions")