diff --git a/orders.py b/orders.py
index 533c63b..39624d4 100644
--- a/orders.py
+++ b/orders.py
@@ -65,6 +65,12 @@ class OrdersHandler(BaseHTTPRequestHandler):
                 self.send_json_response(200, orders[order_id])
             else:
                 self.send_json_response(404, {"error": "Order not found"})
+        elif self.path == "/notes":
+            if not self.check_auth():
+                self.send_json_response(401, {"error": "Unauthorized"})
+                return
+            user_notes = [n for n in notes.values() if n.get("user_id") == getattr(self, "_user_id", None)]
+            self.send_json_response(200, user_notes)
         elif self.path.startswith("/notes/"):
             if not self.check_auth():
                 self.send_json_response(401, {"error": "Unauthorized"})
@@ -77,9 +83,20 @@ class OrdersHandler(BaseHTTPRequestHandler):
                         self.send_json_response(403, {"error": "Forbidden"})
                         return
                     self.send_json_response(200, notes[note_id])
-                else:
-                    self.send_json_response(404, {"error": "Note not found"})
-            elif self.path.startswith("/notes/export"):
+            else:
+                self.send_json_response(404, {"error": "Note not found"})
+        elif self.path.startswith("/notes/") and self.path.endswith("/delete"):
+            note_id = self.path.split("/")[2]
+            if note_id in notes:
+                if notes[note_id].get("user_id") != getattr(self, "_user_id", None):
+                    self.send_json_response(403, {"error": "Forbidden"})
+                    return
+                del notes[note_id]
+                self.send_json_response(200, {"status": "deleted"})
+            else:
+                self.send_json_response(404, {"error": "Note not found"})
+            return
+        elif self.path.startswith("/notes/export"):
                 query_params = self.path.split("?")
                 if len(query_params) > 1:
                     params = dict(p.split("=") for p in query_params[1].split("&"))
@@ -143,6 +160,22 @@ class OrdersHandler(BaseHTTPRequestHandler):
                 self.send_json_response(201, notes[note_id])
             else:
                 self.send_json_response(400, {"error": "Missing title or content field"})
+        elif self.path.startswith("/notes/") and self.path.count("/") == 2:
+            note_id = self.path.split("/")[-1]
+            content_length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(content_length).decode()
+            data = json.loads(body)
+            if note_id in notes:
+                if notes[note_id].get("user_id") != getattr(self, "_user_id", None):
+                    self.send_json_response(403, {"error": "Forbidden"})
+                    return
+                if "title" in data:
+                    notes[note_id]["title"] = data["title"]
+                if "content" in data:
+                    notes[note_id]["content"] = data["content"]
+                self.send_json_response(200, notes[note_id])
+            else:
+                self.send_json_response(404, {"error": "Note not found"})
         elif self.path.endswith("/share"):
             if not self.check_auth():
                 self.send_json_response(401, {"error": "Unauthorized"})